LegionLoader 7z.exe Encrypted .dat Payload Decryption in AppData\Roaming
Detects the LegionLoader malware behavior where a password-protected .dat archive is created in the AppData\Roaming directory followed by the execution of 7z.exe or 7za.exe to extract the hidden payload.
YARA-L
