Trojanized Franz Electron App Spawns ResiLoader via ssh-add.exe DLL Side-Loading

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•1

Detects the execution of ssh-add.exe from a Temp directory, which occurs as part of an attack chain involving a trojanized Franz Electron app. The process leverages DLL side-loading by loading malicious msys-crypto-3.dll, msys-2.0.dll, and msys-gcc_s-seh-1.dll, identified as components of the ResiLoader malware.