Cet article présente une analyse technique approfondie d’une nouvelle famille de malware baptisée Sauron Loader, découverte lors de plusieurs engagements clients en Allemagne. Le malware est vendu sous forme de Malware-as-a-Service (MaaS) dans des forums souterrains russes.
Sauron Loader
Sauron Loader is a Windows C++ malware loader observed in social-engineering campaigns against organizations in Germany.
Sauron Loader
Family profile
Sauron Loader is a Windows C++ malware loader observed in social-engineering campaigns against organizations in Germany. It has been delivered through ClickFix lures and vishing operations, including email bombing followed by callers impersonating IT support and persuading victims to initiate remote-assistance sessions. The malware has been advertised as a malware-as-a-service offering by an underground-forum user known as S4ur0n, reportedly for Russian-speaking criminal users; this advertising does not establish attribution for observed intrusions.
The loader uses DLL side-loading to execute encrypted malicious code in memory and establishes persistence using a recurring scheduled task. It incorporates execution delays and encrypted in-memory loading to impede automated analysis. Sauron Loader profiles infected systems, including host, user, operating-system, privilege, and installed-product details, and communicates with its controllers over encrypted HTTPS using custom Salsa20 encryption and RSA-based message authentication. It can retrieve and execute further payloads, including executables, DLLs, drivers, shellcode, installers, archives, command scripts, PowerShell, VBScript, and JavaScript. It can execute shellcode in memory or inject it into a process, install and start driver services, capture screenshots, and exfiltrate collected system data and screenshots through its command-and-control channel. Configuration logic includes keyboard-layout and public-sector checks reportedly intended to avoid CIS-region and public-sector targets.
Capabilities
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Initial Access
- Persistence
- Post Exploitation
- Process Injection
- Reconnaissance
Samples
Recent samples
1 sandbox sample in the Derp library, newest 1 shown
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
Sauron Loader in ATT&CK
38 distinct techniquesTechniques
38 techniques T1497.003 Time Based Checks T1140 Deobfuscate/Decode Files or Information T1113 Screen Capture T1053.005 Scheduled Task T1082 System Information Discovery T1566.004 Spearphishing Voice T1071.001 Web Protocols T1030 Data Transfer Size Limits T1573 Encrypted Channel T1105 Ingress Tool Transfer T1204.002 Malicious File T1027 Obfuscated Files or Information T1033 System Owner/User Discovery T1573.001 Symmetric Cryptography T1219 Remote Access Tools T1566.003 Spearphishing via Service T1041 Exfiltration Over C2 Channel T1106 Native API T1620 Reflective Code Loading T1218.011 Rundll32 T1573.002 Asymmetric Cryptography T1027.013 Encrypted/Encoded File T1059.005 Visual Basic T1027.007 Dynamic API Resolution T1036.005 Match Legitimate Resource Name or Location T1059.003 Windows Command Shell T1057 Process Discovery T1016 System Network Configuration Discovery T1059.007 JavaScript T1055.012 Process Hollowing T1614.001 System Language Discovery T1218.010 Regsvr32 T1518.001 Security Software Discovery T1480.001 Environmental Keying T1059.001 PowerShell T1218.007 Msiexec T1543.003 Windows Service T1667 Email Bombing