LegionLoader is the name given to a malware payload identified in a reported delivery chain. A payload is the malicious software delivered to a system; the term does not, by itself, identify how it was delivered or what actions it performs. In the reported context, researchers associated LegionLoader with ROMULUS infrastructure and an unusually large executable, but the available details do not establish that a particular scanner was bypassed or that victims were compromised.
For defenders, the name is a useful indicator to investigate, not proof of infection. Examine suspicious files using controlled analysis, and check whether security tools fully inspect oversized executables or instead defer, limit, or skip analysis. Correlate file provenance and size with user activity, process execution, and network connections. This helps distinguish a suspicious delivery attempt from confirmed execution and keeps file-size anomalies from becoming blind spots.