Sauron Loader Malware Evades Detection with DLL Side-Loading

Key Takeaways

• Sauron Loader is a new malware actively targeting organizations, particularly in Germany.
• It uses sophisticated evasion techniques like DLL side-loading and in-memory decryption to bypass detection.
• Initial infection often relies on social engineering, including fake IT support calls and deceptive prompts, rather than exploiting software vulnerabilities.
• Once established, Sauron Loader can download further malicious payloads, gather system information, and exfiltrate data.
• Defenders should prioritize vigilance against social engineering, monitor for unusual system activity, and implement robust endpoint detection.

A novel malware variant, dubbed Sauron Loader, has been identified in attacks targeting German organizations. This sophisticated loader facilitates the delivery of additional malicious software, employing advanced evasion tactics to remain undetected. Analysis indicates that Sauron Loader typically infiltrates systems through social engineering rather than exploiting newly discovered software flaws, often serving as a final stage in complex attack chains.

In observed incidents, threat actors leveraged various deceptive techniques. Some victims encountered fake “ClickFix” style prompts designed to trick them into executing harmful commands. Other campaigns began with a deluge of spam emails, followed by phone calls from individuals impersonating IT support, creating a fabricated problem and then offering a malicious “solution” to gain unauthorized access.

Cybersecurity researchers at DCSO CyTec Blog uncovered this new malware during recent investigations, linking it to advertisements on underground forums. DCSO said in a report that the tool was marketed to Russian-speaking cybercriminals, with the seller claiming specific targeting restrictions. However, these restrictions do not provide definitive identification of the attackers themselves.

The primary concern surrounding Sauron Loader is its post-compromise capabilities. Once successfully installed, the loader can download and execute arbitrary programs, collect detailed information about the compromised system, and transmit stolen data back to its command-and-control (C2) infrastructure. While researchers have identified the loader’s capabilities, the specific final payloads deployed or the precise number of affected systems in every incident remain unquantified.

Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption

One particular attack examined by researchers demonstrated a highly stealthy infection method. A Windows installer was used to place a legitimate executable file alongside two malicious dynamic-link libraries (DLLs). When the unsuspecting, trusted program was launched, it inadvertently loaded one of the attacker-supplied malicious DLLs from its directory.

This technique, known as DLL side-loading, allows the legitimate program to appear and function normally while the malicious library executes its nefarious code. The use of this method, particularly in conjunction with installer-based delivery, highlights a significant challenge for traditional security tools, as the initial execution originates from a trusted process.

The first malicious DLL contained the core code of the Sauron Loader in an encrypted state. It then invoked the second malicious DLL, which was responsible for decrypting the loader’s code directly into the computer’s memory and transferring execution control. This in-memory decryption strategy makes file-based scanning less effective, as the malicious payload is never written to disk in its executable form.

Furthermore, the malware incorporates a deliberate pause during the decryption process. Researchers hypothesize that this delay is intended to thwart automated analysis systems, which might flag rapid execution or memory changes as suspicious. The second malicious DLL also establishes a scheduled task, ensuring the loader’s persistent execution at regular intervals. This combination of a legitimate executable, concealed code, and scheduled re-launches provides attackers with multiple avenues to maintain access without exposing an easily identifiable standalone malicious program.

The discovery of trusted software being leveraged to load malicious libraries underscores a broader detection problem in cybersecurity. While this specific threat is distinct, it mirrors other instances where attackers exploit legitimate application behaviors for malicious ends. The researchers also noted the existence of related samples of Sauron Loader exhibiting identical core functionality but connecting to different C2 infrastructures. This variation is crucial for defenders, as blocking a single server or recognizing one installer variant will not guarantee protection against all instances of this malware family.

Remote Tasks and Defensive Clues

Once Sauron Loader becomes active on a system, it retrieves a hidden configuration file that dictates its operational parameters and C2 server details. It then registers the compromised machine, transmitting system information such as the computer name, current user, and Windows version, before awaiting further commands from its operators.

The malware communicates with its C2 infrastructure using encrypted HTTPS requests, with frequently changing web paths. This dynamic approach makes it significantly more challenging for network traffic analysis to discern the actual commands being issued.

Sauron Loader’s operators can instruct it to download additional files either directly or via the control server. The loader supports a wide array of payload types, including executables, libraries, installers, and scripts. It also possesses the capability to capture screenshots of the compromised system, segmenting them into smaller pieces for exfiltration. These robust functionalities establish Sauron Loader as a versatile delivery platform, rather than merely an indicator of a single, specific later-stage malware infection.

The social engineering tactics employed are as critical to the attack’s success as the technical obfuscation. Similar email bombing and fake support scams have been observed using comparable pressure tactics to gain remote access, though these do not necessarily imply a direct link to Sauron Loader campaigns. In one documented Sauron incident, an attacker verbally directed the target to initiate a remote assistance session, effectively manipulating the victim into granting access.

What You Should Do

• Enhance Social Engineering Awareness: Educate employees about common social engineering tactics, including fake IT support calls, deceptive prompts, and suspicious emails. Emphasize verification procedures for any unexpected requests for remote access or software installation.
• Implement Application Whitelisting: Restrict the execution of unauthorized applications and libraries to prevent DLL side-loading attacks.
• Monitor for Unusual Activity: Implement robust endpoint detection and response (EDR) solutions to identify unexpected installer activity, unusual loading of DLLs by legitimate programs, newly created scheduled tasks (e.g., “keyroll”), and unexplained encrypted outbound network connections.
• Verify Helpdesk Contact: Establish clear protocols for verifying legitimate IT support contact through official, internal channels, especially after receiving a large volume of spam. Never follow instructions from unsolicited callers or emails that instruct you to run “quick fix” commands.
• Utilize Threat Intelligence: Incorporate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems and other defensive tools for proactive detection.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.