msaRAT MSI dropper and embedded lib.dll payload

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•3

Detects the presence of the msaRAT MSI dropper (update_ms.msi) and its associated embedded payload (lib.dll), identified by the 'RUN' export and specific msa* string bindings used for inter-process communication or internal functionality.