Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection
Sauron Loader, sold to Russian-speaking criminals, uses DLL side-loading and memory decryption against German organizations.
DCSO CyTec says Sauron Loader has been used against German organizations after ClickFix prompts or inbox flooding followed by calls from fake IT support. In one chain a Windows installer places a legitimate executable beside malicious libraries; the trusted program side-loads the loader, which decrypts its code in memory and creates a recurring scheduled task. Once active it registers host details over HTTPS, can run additional executables, libraries, installers and scripts, and can return screenshots. Related samples share that behavior but use different controller infrastructure.
- Seen against German organizations after ClickFix lures or fake IT-support calls.
- A trusted executable side-loads libraries that decrypt the loader in memory.
- A scheduled task relaunches it; it profiles hosts and can capture screenshots.
- Sold to Russian-speaking criminals, with multiple distinct HTTPS controllers.
- ATT&CK
- T1574.002 DLL Side-LoadingT1204.004 Malicious CommandT1053.005 Scheduled TaskT1140 Deobfuscate/Decode Files or InformationT1113 Screen Capture
- Vendors
- Microsoft
- Products
- Windows
- Malware
- Sauron Loader
- Victims
- German organizations
- Organizations
- DCSO
- Countries
- Germany
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.lahaina-shores.com | om Configured command-and-control endpoint C2 URL https[://]api[.]lahaina-shores[.]com Configured command-and-control endpoint Note: IP addres |
| domain | api.namsb-show.com | l Task that repeatedly launches the loader C2 URL https[://]api[.]namsb-show[.]com Configured command-and-control endpoint C2 URL https[:/ |
| domain | api.quinlantours.com | om Configured command-and-control endpoint C2 URL https[://]api[.]quinlantours[.]com Configured command-and-control endpoint C2 URL https[:/ |
| domain | api.virtual-magic.com | om Configured command-and-control endpoint C2 URL https[://]api[.]virtual-magic[.]com Configured command-and-control endpoint C2 URL https[:/ |
| sha256 | 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991 | df0955d9fb599f2c11dfa1d0f8f2 Analyzed MSI installer SHA-256 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991 Legitimate executable used for side-loading SHA-256 5606afd |
| sha256 | 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8 | 00d3991 Legitimate executable used for side-loading SHA-256 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8 Malicious loader library SHA-256 6551293e996d19755ba497f50b |
| sha256 | 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7 | 810e29bfe78528733284ad1bf8 Malicious loader library SHA-256 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7 Malicious decryption and persistence library File name rnpk |
| sha256 | ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2 | s of compromise (IoCs):- Type Indicator Description SHA-256 ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2 Analyzed MSI installer SHA-256 194d7e8870ff783ce1e4e4e3015c |
From the original article
4 min read at cybersecuritynews.com
Sauron Loader has surfaced in attacks on German organizations, giving intruders a way to deliver more malware. The new tool need not be the first thing a victim encounters. In the cases examined, it arrived at the end of attack chains built around deception rather than a newly disclosed software flaw.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.