Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection

Sauron Loader has surfaced in attacks on German organizations, giving intruders a way to deliver more malware. The new tool need not be the first thing a victim encounters.

In the cases examined, it arrived at the end of attack chains built around deception rather than a newly disclosed software flaw. Some victims faced ClickFix style fake prompts that tried to make them run harmful instructions.

In other cases, attackers first flooded inboxes with spam, then called while posing as IT support. That sequence created a problem and offered a false solution, making malicious action look like help.

Analysts from DCSO CyTec Blog identified the malware in recent investigations and linked it to an underground sales post.

DCSO said in a report shared with Cyber Security News (CSN) that the tool was advertised to Russian-speaking criminals. Its seller claimed targeting restrictions, although these do not identify the attackers.

The concern is what the loader does after gaining a foothold. It can fetch and run additional programs, collect information about a victim’s computer, and send material back to its controllers. Investigators did not quantify affected systems or identify a final payload in every case.

Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption

One analyzed attack used a Windows installer to place a legitimate executable beside two malicious support libraries. When the trusted program started, it loaded a nearby library supplied by the attacker.

This is DLL side-loading: the visible program can appear routine while the added library starts the malicious chain. Similar ClickFix installer delivery attacks show why this pairing deserves scrutiny.

The first malicious library carried the loader’s main code in encrypted form. It then called the second library, which decrypted that code directly in the computer’s memory and handed control to it.

Keeping the working code hidden until execution can make a file scan less revealing. The malware also paused during decryption, a delay researchers believe may frustrate automated analysis.

That second library also created a scheduled task to start the loader again at intervals. The combination of a trusted executable, concealed code, and repeated launches gives attackers several chances to keep their access without presenting an obvious standalone malicious program.

Reports of trusted software loading malicious libraries illustrate the broader detection problem, though they describe a separate threat.

The installer sample is only one route the researchers examined. They also found related samples with the same core behavior but different controller infrastructure.

That variation matters because blocking a single server or recognizing one installer will not necessarily cover every instance of the malware family.

Remote Tasks and Defensive Clues

Once active, Sauron Loader reads a hidden configuration that tells it where to connect and how to operate. It registers the infected computer, including details such as its name, user and Windows version, then checks for instructions.

Its traffic uses encrypted HTTPS requests with changing web paths, making the actual commands harder to see from network traffic alone.

Operators can tell it to download further files directly or request them through its control server. The loader supports executables, libraries, installers, scripts and other payload types.

It can also capture screenshots and return them in smaller pieces. Those capabilities make the infection a delivery platform rather than evidence that any particular later-stage malware ran in every incident.

The social engineering is just as important as the technical disguise. Other email bombing and fake support attacks have used the same pressure tactic to secure remote access, but that does not link those campaigns to Sauron.

In one investigated Sauron incident, a caller instructed the target to begin a remote assistance session. For defenders, the research supports checking unexpected installer activity, unusual library loads by otherwise legitimate programs, newly created recurring tasks, and unexplained encrypted outbound connections.

Verify unexpected helpdesk contact through an established internal channel, especially after an inbox flood, and do not run commands presented as quick fixes.

DCSO published detection material alongside its findings for teams investigating suspected infections before additional malicious payloads arrive.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC