Threats Tagged 'labubarat'

LabubaRAT is a custom 64-bit Rust-based remote access trojan targeting Windows systems, masquerading as legitimate NVIDIA software. It offers extensive remote control features such as command execution, file operations, screen capture, and SOCKS5 proxying. The malware is part of a malware-as-a-service framework, managed via a backend called LabubaPanel hosted on German infrastructure. It uses its own JavaScript execution for delivery and employs evasion techniques including impersonation of NVIDIA components and abuse of Microsoft build utilities. First observed in July 2026, it is unsigned and designed for persistence and stealth.

A previously undocumented remote access tool named LabubaRAT has been identified, masquerading as NVIDIA software through fake metadata and runtime artifacts. This Rust-based malware creates persistent footholds enabling hands-on operator activity including host profiling, security tool identification, command execution, file transfers, screenshot capture, and traffic proxying. The implant supports multiple communication methods including HTTPS polling, WebView2-based communication, and DNS tunneling. It uses a configurable framework model with organization, group, server, and API key parameters suggesting a Malware-as-a-Service platform. The malware maintains local state in SQLite databases and provides comprehensive remote access capabilities including PowerShell and JavaScript execution, SOCKS5 proxy support, and user-level persistence through registry autoruns. Infrastructure analysis revealed LabubaPanel branding with associated command and control servers hosted on German providers.