Rust/Tokio Malicious DLL Loaded via msiexec Sizes Worker Thread Pool

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects a DLL loaded into msiexec.exe that exports a function named RUN and exhibits Tokio async-runtime initialization behavior, reading the TOKIO_WORKER_THREADS environment variable and/or calling GetSystemInfo followed by multiple CreateThread calls to size its worker thread pool. Matches msaRAT behavior where the malicious Rust/Tokio DLL is loaded via an MSI custom action running under msiexec.exe.