Sauron Loader Outbound C2 Registration Beacon from rnpkeys.exe

Ibrahim Saud@tektrix

•updated 10 days ago•1•0•1

Detects network communication from 'rnpkeys.exe' to external IP addresses. This behavior is indicative of the Sauron Loader malware, which utilizes a side-loaded 'rnpkeys.exe' binary to establish beaconing and C2 communication as part of its registration process.