Hackers are delivering LegionLoader via an executable file that has been inflated to 882,716,672 bytes, or roughly 842 MiB, to bypass security scanning limits This article explores hackers delivering legionloader. . Researchers discovered the delivery chain while examining ROMULUS, a shared ClickFix platform that supports various malware payloads.

The investigation revealed six IP addresses exposing ROMULUS panels and two delivery routes: one using a modified Stardock installer and the other distributing LegionLoader through encrypted archives. Huntress previously documented attackers exploiting ChatGPT Custom GPTs to lure victims into malicious installers and remote access malware. It concealed its console window and downloaded an encrypted archive from orbitflownetwork[. ]lol, alongside the legitimate 7zr.exe extraction utility from GitHub.

This method can circumvent scanner detection, evade sandbox processing limits, and surpass static analysis thresholds.

Two decryption stages, employing AES encryption and byte reversal, were followed by a custom loader that placed the final 475,648-byte LegionLoader payload into memory. Previous research by AhnLab identified LegionLoader as using staged decryption, a custom executable loader, and ClickFix distribution, supporting the identification of this malware family. Indicators of Compromise Indicator Type Context 96.62.224[.

]81 IPv4 address Huntress-documented ClickFix delivery node; ROMULUS frontend observed 86.109.75[. ]7 IPv4 address ROMULUS server delivering the Stardock package and LegionLoader staging script