Red Lamassu JFMBackdoor flt.bin In-Memory Load via fltMC.exe from TEMP
Detects the execution of Red Lamassu's JFMBackdoor payload by monitoring for fltMC.exe being launched from temporary directories. The rule identifies a sideloading technique where fltMC.exe loads a malicious FLTLIB.dll, which then injects the flt.bin shellcode stub into memory, avoiding writing the malicious PE file to disk.
YARA-L
