curl.exe downloads update_ms.msi to ProgramData (Chaos msaRAT)

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•2

Detects the use of curl.exe to download a file named 'update_ms.msi' and save it to the 'C:\ProgramData\' directory. This activity is indicative of the msaRAT loader, a component often associated with Chaos ransomware, using the curl utility to drop malicious installer packages for execution.