Steganographic Loader Chain: Optimax.dll + System Optimizer Ultimate In-Memory Load
Detects a multi-stage in-memory .NET DLL loader chain where an executable from AppData\Roaming mimics legitimate software (TuglaInsaatci) to load malicious DLLs ('Optimax.dll' and 'System Optimizer Ultimate.dll') entirely in memory. This behavior is indicative of the FortiBleed steganographic loader campaign, which aims to evade disk-based security controls.
YARA-L
