LegionLoader Sandbox Evasion via Compound Registry Fingerprinting from AppData
Detects LegionLoader malware performing environmental fingerprinting by querying specific Windows registry keys (Internet Settings Zones and CentralProcessor) in rapid succession. This behavior is indicative of a multi-stage check to identify sandbox or virtual machine environments before executing the final payload.
YARA-L
