SharkLoader Anti-Debug: IsDebuggerPresent, NtQueryInformationProcess, GetTickCount Evasion

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.