Executive Summary
LegionLoader is a sophisticated multi-stage malware loader that primarily utilizes MSI installers to initiate an infection chain characterized by extensive defense evasion. The malware leverages Living-off-the-Land Binaries (LOLBins) such as msiexec.exe and cmd.exe to execute malicious batch scripts and stage payloads in the AppData\Roaming directory.
Technically, the variant employs DLL sideloading by placing malicious libraries—impersonating legitimate files like 7z.dll and normaliz.dll—alongside trusted binaries. It further utilizes Python-based modules for network communication and performs environmental checks on registry keys, such as Internet Explorer security settings, to detect sandboxes or debuggers before proceeding with its primary mission. This approach minimizes its static footprint while ensuring persistence through staged scripts and renamed installers.