Threats Tagged 'labubarat'

LabubaRAT is a Rust-based remote access tool that masquerades as NVIDIA software using fake metadata and runtime artifacts. It establishes persistent access on infected hosts, enabling operators to perform host profiling, identify security tools, execute commands, transfer files, capture screenshots, and proxy traffic. The malware supports multiple communication channels including HTTPS polling, WebView2-based communication, and DNS tunneling. It uses a configurable framework with parameters suggesting a Malware-as-a-Service model and maintains local state in SQLite databases. LabubaRAT also supports PowerShell and JavaScript execution, SOCKS5 proxy functionality, and user-level persistence via registry autoruns. Its command and control infrastructure, branded as LabubaPanel, is hosted on German providers.