LegionLoader DLL Sideloading via Suspicious AppData\Roaming Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects LegionLoader malware activity involving the creation of known-malicious DLLs (7z.dll, normaliz.dll, msvcr90.dll) or the malicious batch script 'xupdate.bat' within non-standard subdirectories of AppData\Roaming. This behavior is indicative of DLL sideloading used to maintain persistence or execute malicious payloads.