Curl Download of update_ms.msi from 172.86.126.18

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•1•0•4

Detects the use of curl.exe to download a specific file named 'update_ms.msi' from a known malicious IP address. This behavior is indicative of a stager for msaRAT being downloaded onto a Windows host, potentially disguised to mimic a legitimate Windows update file.