Red Lamassu 1.bat Dropper Downloading JFMBackdoor Components from 23.27.201.160

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).