MSI Custom Action CA_Run_EA2AEBC3/Bin_lib_EA2AEBC3 Loads lib.dll via RUN Export

Duo Tech@duotech

•updated Jul 24, 2026•1•0•5

Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.