LABUBARAT: Rust-Based RAT Posing as NVIDIA Software

Summary

LabubaRAT is a previously unreported remote access tool written in Rust that disguises itself as legitimate NVIDIA software. It offers broad remote control functionality, including command execution, file transfer, and SOCKS5 proxy support. The malware is built as a reusable framework that can be easily adapted for different campaigns through command-line arguments or environment variables.

Investigation

Blackpoint Cyber’s Adversary Pursuit Group analyzed the malware and found that it uses fake NVIDIA metadata and runtime artifacts to blend into Windows systems. The investigation showed a highly configurable agent architecture that relies on a SQLite database for local state and supports several command-and-control channels, including HTTPS, WebView2, and DNS tunneling. Researchers also identified related infrastructure featuring a LabubaPanel management interface.

Mitigation

Organizations should verify unsigned binaries that claim to originate from trusted vendors such as NVIDIA, especially when they execute from unusual paths. Strong monitoring for suspicious command-line arguments, particularly lengthy Base64-encoded strings, is essential. Defenders should also watch for unauthorized persistence through HKCU\Run registry keys and abnormal script execution through Windows Script Host.

Response

If LabubaRAT is detected, security teams should determine the scope of compromise by searching for the nvctr_sys.db database and the nvidia-sysruntime.exe executable. Investigators should review outbound traffic for high-entropy DNS requests and for non-browser processes using browser-like User-Agent strings. Host-level review should also identify accessed files and executed commands to assess possible data theft or lateral movement.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The attacker has successfully deployed the LabubaRAT binary, renamed to nvidia-sysruntime.exe, into a directory on the target system. To begin interactive command execution and further reconnaissance, the malware spawns a cmd.exe instance. This parent-child relationship (nvidia-sysruntime.exe -> cmd.exe) is the specific telemetry pattern the detection rule is designed to intercept.

• Regression Test Script: This script mimics the RAT by creating a dummy executable with the target name and then spawning a command shell from it.

  # Simulation Script: LabubaRAT Masquerade
  $workDir = "$env:TEMPNVIDIA_Update"
  New-Item -Path $workDir -ItemType Directory -Force
  $targetExe = "$workDirnvidia-sysruntime.exe"
  
  # Create a dummy executable (using a renamed copy of cmd for simulation purposes)
  Copy-Item "C:WindowsSystem32cmd.exe" -Destination $targetExe
  
  # Execute the 'malicious' process and have it spawn a child process (cmd.exe)
  # This simulates the parent-child relationship defined in the rule.
  Start-Process -FilePath $targetExe -ArgumentList "/c echo LabubaRAT Simulation Triggered & pause" -Wait

• Cleanup Commands:

  # Cleanup Script
  $workDir = "$env:TEMPNVIDIA_Update"
  if (Test-Path $workDir) {
      Remove-Item -Path $workDir -Recurse -Force
  }