Sauron Loader Malware Employs DLL Side-Loading and In-Memory Decryption to Evade German Targets
A new malware loader, Sauron, is targeting German organizations with sophisticated evasion techniques including DLL side-loading and in-memory decryption, delivered via social engineering tactics.
A new malware loader dubbed Sauron has emerged, specifically targeting organizations in Germany and employing advanced techniques to evade detection. Unlike many threats that exploit newly discovered software vulnerabilities, Sauron is delivered through multi-stage attack chains that rely on social engineering. Attackers have been observed using deceptive tactics such as fake prompts that trick users into executing malicious instructions, or a more elaborate scheme involving initial spam campaigns followed by phone calls from fake IT support personnel offering a "solution" to a problem they created.
Security researchers from DCSO CyTec Blog identified Sauron Loader during recent investigations and noted its advertisement on underground forums catering to Russian-speaking criminals. While the seller claimed targeting restrictions, the true extent of its reach and the identity of the operators remain unclear. The primary concern surrounding Sauron Loader lies in its functionality once it gains a foothold on a victim's system. It is designed as a versatile delivery platform, capable of downloading and executing additional malicious payloads, gathering sensitive system information, and exfiltrating data back to its command and control (C2) infrastructure.
One analyzed attack chain involved a Windows installer placing a legitimate executable alongside two malicious DLL files. When the trusted executable was launched, it inadvertently loaded a malicious library supplied by the attacker, a technique known as DLL side-loading. This method allows the malware to masquerade as a legitimate process, making initial detection more difficult. The first malicious library contained the loader's core code in an encrypted form, which was then passed to a second library responsible for decrypting the code directly in the system's memory before execution.
This in-memory decryption strategy is a key evasion tactic, as it avoids writing the decrypted malicious code to disk, thereby bypassing file-scanning antivirus solutions. Researchers also observed that the malware introduced a deliberate pause during the decryption process, which they believe is intended to frustrate automated analysis tools. Furthermore, the second malicious library established a scheduled task to ensure the loader would relaunch periodically, providing attackers with persistent access and multiple opportunities to maintain their presence without relying on a single, easily identifiable malicious executable.
Investigators found that Sauron Loader's flexibility extends to its command and control (C2) infrastructure. While one analyzed sample used a specific set of C2 servers, related samples with identical core behaviors but different controller infrastructure were also discovered. This variation means that blocking a single C2 domain or IP address may not be sufficient to disrupt all Sauron Loader infections, highlighting the need for broader network monitoring and threat intelligence.
Once active, Sauron Loader retrieves a hidden configuration file that dictates its operational parameters and C2 communication. It registers the infected machine by collecting details such as the computer name, username, and Windows version. The malware then communicates with its C2 servers using encrypted HTTPS requests with dynamic web paths, making it challenging to identify malicious commands within network traffic. Operators can instruct the loader to download various payload types, including executables, libraries, installers, and scripts, or to capture screenshots of the victim's activity.
Defenders are advised to monitor for unusual activity such as unexpected installer behavior, legitimate programs loading unauthorized DLLs, newly created scheduled tasks, and unexplained encrypted outbound network connections. The social engineering aspect is equally critical; verifying unexpected helpdesk contacts through established internal channels, especially after a flood of spam, is crucial. Users should be cautious about running commands presented as quick fixes or solutions to problems they did not initiate. DCSO has released detection materials to aid security teams in identifying and responding to suspected Sauron Loader infections before further malicious payloads can be deployed.