Sauron Loader installer chain file hashes (MSI/rnp.dll/tdwp.dll)

Ibrahim Saud@tektrix

•updated 10 days ago•0•0•1

This rule uses YARA to identify specific malicious files associated with the Sauron Loader malware, including the MSI installer and associated support DLLs (rnp.dll, tdwp.dll), based on their known SHA-256 hashes.