Sauron Loader Installer and Side-Loaded DLL Hash Match

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•2

Detects known components of the Sauron malware, including MSI installers, side-loaded executables (rnpkeys.exe), and malicious DLLs (rnp.dll, tdwp.dll) by matching known SHA-256 file hashes. It also includes a YARA rule for detecting PE binaries containing the string 'Sauron'.