SharkLoader Dropper Deploying Components into AppData xwreg or xgdf

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects behavior consistent with the SharkLoader malware, including the creation of malicious components in %APPDATA% subdirectories (xwreg, xgdf), the execution of SystemSettings.exe from these non-standard directories, and the execution of commands via cmd.exe initiated from these paths. It also identifies file staging activities in %TEMP%\aswerf.