LegionLoader Dynamic API Resolution and Pointer Encoding in AppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious files, modules, or batch scripts executed from or staged within AppData Roaming directories, specifically targeting known patterns such as custom utils folders, DLL sideloading impersonation (e.g., 7z.dll, normaliz.dll), and Python C2 module components.