ResiLoader Run Key Persistence via Google Update Masquerade (ssh-add.exe)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•2

Detects the creation of a Windows Registry Run key that points to an executable named 'ssh-add.exe' located in 'C:\ProgramData\Google Update'. This behavior is associated with the ResiLoader malware, which uses this technique for persistence by masquerading as a legitimate Google update process.