Detection of LegionLoader - Decryption Attempt of drata.dat via 7-Zip in Traiolx Directory

ryan o riordan@riordz

•updated Jul 28, 2025•1•27

This detection monitors the execution of 7zG.exe—the 7-Zip GUI executable—specifically when launched from the Traiolx Custom Utils or Kilo Verfair Tools directory under the user’s Roaming profile (\\AppData\\Roaming\\Traiolx Custom Utils). It identifies suspicious command-line activity where 7zG.exe is used to decrypt or extract a file named drata.dat, used to load second payload.