Cybersecurity experts have identified a new remote access trojan (RAT) named LabubaRAT, developed using the Rust programming language. This malware masquerades as NVIDIA software to infiltrate Windows systems, providing attackers with extensive control over compromised machines.
LabubaRAT establishes a persistent presence on infected systems, enabling operators to perform various malicious activities. These include profiling the host environment, detecting installed security tools, executing commands, transferring files, capturing screenshots, and routing network traffic through the compromised system. The malware employs multiple communication methods, such as HTTPS, WebView2, and DNS tunneling, to maintain access even if one channel is disrupted.
Notably, LabubaRAT appears to be offered as part of a malware-as-a-service (MaaS) model, allowing different threat actors to deploy it across various campaigns. The initial infection vector involves an executable named “nvidia-sysruntime.exe,” which impersonates NVIDIA’s container runtime toolkit. Unlike many malware samples that hard-code command-and-control (C2) information, LabubaRAT accepts configuration parameters at runtime via command-line arguments. This flexibility enables attackers to specify C2 server details and polling intervals dynamically, facilitating reuse of the same binary across different infrastructures and targets.
Upon execution, LabubaRAT stores its configuration in a local SQLite database and conducts reconnaissance to inventory installed web browsers and security products. It specifically checks for applications like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, and security solutions from vendors such as Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro. Additionally, the malware collects system information, including hostname, RAM size, CPU model, and the status of Windows User Account Control (UAC), to tailor its operations based on the security environment.
LabubaRAT’s capabilities are extensive, allowing attackers to execute commands, run PowerShell scripts, execute JavaScript, capture screenshots, upload and download files, handle archives, and establish SOCKS5 proxies. These features grant operators comprehensive control over the infected host, enabling them to interact with the system, exfiltrate data, and maintain persistent access without the need for additional tools.
The malware’s name derives from the “LabubaPanel” associated with its C2 infrastructure and a Labubu-themed favicon. The combination of runtime configuration, local state management, host profiling, multiple communication channels, and operator tasking makes LabubaRAT a versatile and potent tool for cybercriminals.
The emergence of LabubaRAT underscores the evolving sophistication of malware threats. Its use of Rust—a language known for its performance and safety features—along with dynamic configuration and multiple communication methods, highlights the need for robust cybersecurity measures. Organizations should remain vigilant, regularly update their security tools, and educate employees about the risks of downloading and executing software from untrusted sources to mitigate such threats.
