Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection

Sauron Loader has surfaced in attacks on German organizations, giving intruders a way to deliver more malware. The new tool need not be the first thing a victim encounters.

In the cases examined, it arrived at the end of attack chains built around deception rather than a newly disclosed software flaw. Some victims faced ClickFix style fake prompts that tried to make them run harmful instructions.

In other cases, attackers first flooded inboxes with spam, then called while posing as IT support. That sequence created a problem and offered a false solution, making malicious action look like help.

Analysts from DCSO CyTec Blog identified the malware in recent investigations and linked it to an underground sales post.

DCSO said in a report shared with Cyber Security News (CSN) that the tool was advertised to Russian-speaking criminals. Its seller claimed targeting restrictions, although these do not identify the attackers.

The concern is what the loader does after gaining a foothold. It can fetch and run additional programs, collect information about a victim’s computer, and send material back to its controllers. Investigators did not quantify affected systems or identify a final payload in every case.

Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption

One analyzed attack used a Windows installer to place a legitimate executable beside two malicious support libraries. When the trusted program started, it loaded a nearby library supplied by the attacker.

This is DLL side-loading: the visible program can appear routine while the added library starts the malicious chain. Similar ClickFix installer delivery attacks show why this pairing deserves scrutiny.

The first malicious library carried the loader’s main code in encrypted form. It then called the second library, which decrypted that code directly in the computer’s memory and handed control to it.

Keeping the working code hidden until execution can make a file scan less revealing. The malware also paused during decryption, a delay researchers believe may frustrate automated analysis.

That second library also created a scheduled task to start the loader again at intervals. The combination of a trusted executable, concealed code, and repeated launches gives attackers several chances to keep their access without presenting an obvious standalone malicious program.

Reports of trusted software loading malicious libraries illustrate the broader detection problem, though they describe a separate threat.

The installer sample is only one route the researchers examined. They also found related samples with the same core behavior but different controller infrastructure.

That variation matters because blocking a single server or recognizing one installer will not necessarily cover every instance of the malware family.

Remote Tasks and Defensive Clues

Once active, Sauron Loader reads a hidden configuration that tells it where to connect and how to operate. It registers the infected computer, including details such as its name, user and Windows version, then checks for instructions.

Its traffic uses encrypted HTTPS requests with changing web paths, making the actual commands harder to see from network traffic alone.

Operators can tell it to download further files directly or request them through its control server. The loader supports executables, libraries, installers, scripts and other payload types.

It can also capture screenshots and return them in smaller pieces. Those capabilities make the infection a delivery platform rather than evidence that any particular later-stage malware ran in every incident.

The social engineering is just as important as the technical disguise. Other email bombing and fake support attacks have used the same pressure tactic to secure remote access, but that does not link those campaigns to Sauron.

In one investigated Sauron incident, a caller instructed the target to begin a remote assistance session. For defenders, the research supports checking unexpected installer activity, unusual library loads by otherwise legitimate programs, newly created recurring tasks, and unexplained encrypted outbound connections.

Verify unexpected helpdesk contact through an established internal channel, especially after an inbox flood, and do not run commands presented as quick fixes.

DCSO published detection material alongside its findings for teams investigating suspected infections before additional malicious payloads arrive.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2	Analyzed MSI installer
SHA-256	194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991	Legitimate executable used for side-loading
SHA-256	5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8	Malicious loader library
SHA-256	6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7	Malicious decryption and persistence library
File name	rnpkeys.exe	Legitimate executable placed by the installer
File name	rnp.dll	Side-loaded malicious library
File name	tdwp.dll	Malicious decryption and persistence library
Directory	C:\ProgramData\keyroll	Hardcoded location for the extracted files
Scheduled task	keyroll	Task that repeatedly launches the loader
C2 URL	https[://]api[.]namsb-show[.]com	Configured command-and-control endpoint
C2 URL	https[://]api[.]quinlantours[.]com	Configured command-and-control endpoint
C2 URL	https[://]api[.]virtual-magic[.]com	Configured command-and-control endpoint
C2 URL	https[://]api[.]lahaina-shores[.]com	Configured command-and-control endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC