labubarat

The labubarat tag tracks reporting on LabubaRAT, a 64-bit Windows remote access trojan written in Rust and disguised as NVIDIA container software. Coverage focuses on the malware’s capabilities, including command execution, file transfer, screenshot capture, persistence, and network-proxy functions. It also highlights practical detection clues for defenders: the unsigned nvidia-sysruntime.exe executable, the nvctr_sys.db local database, and suspicious user-level autorun entries containing Base64-encoded arguments. This tag is useful for security professionals investigating NVIDIA-themed malware impersonation, endpoint persistence, and hunting activity associated with LabubaRAT. The documented sample was analyzed after appearing as the “NVIDIA Container Runtime Monitor.”