Most Sakula samples maintain persistence by setting the Registry Run key "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in the HKLM or HKCU hive, with the Registry value and file name varying by sample.