msaRAT lib.dll loaded into browser process (ECDH/ChaCha-Poly1305 C2 layer)

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects the loading of the msaRAT 'lib.dll' malicious module into Google Chrome or Microsoft Edge browser processes. This DLL is used to facilitate encrypted C2 communication, specifically performing ECDH key exchange and ChaCha-Poly1305 encryption on top of WebRTC DataChannel traffic.