SharkLoader Encrypted PE Resource Section Load: DscCoreR.mui/SyncRes.dat

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

This rule detects file access events involving specific file names ('DscCoreR.mui', 'SyncRes.dat', 'GameInputInboxs32.mui', 'diagerr.xml', 'NtfsLog.etl', 'Ignored.Dat', 'VistaCompat.nls') that have been historically observed as indicators of the HUI Loader malware. HUI Loader is a custom DLL loader used by various threat actors to sideload malicious payloads.