Synthèse
After launching the Tokio runtime, msaRAT attempts to manipulate the browser. As the first step toward that goal, it searches for the installation path of Chrome or Edge on the victim machine. 1. Path Discovery via Environment Variables The malware attempts the following combinations in priority order, checking whether the file exists at each path. Table 1. Browser search targets and priority order. Figure 6. Chrome and Edge path discovery (pseudocode). If no path is found through environment va
After launching the Tokio runtime, msaRAT attempts to manipulate the browser. As the first step toward that goal, it searches for the installation path of Chrome or Edge on the victim machine. 1. Path Discovery via Environment Variables The malware attempts the following combinations in priority order, checking whether the file exists at each path. Table 1.
Browser search targets and priority order. Figure 6. Chrome and Edge path discovery (pseudocode). If no path is found through environment variables, the malware falls back to searching for Chrome exclusively via the registry. Figure 7.
Locating Chrome via registry values If no matching browser is found, the Chrome DevTools Protocol (CDP) manipulation described later will not be executed.