LabubaRAT: A New Malware Disguised as NVIDIA Software
This Rust-based remote access trojan is infiltrating systems.
1What is LabubaRAT?
LabubaRAT is a Rust-based remote access trojan that masquerades as NVIDIA software. This malware creates a persistent foothold in target systems to carry out various malicious activities.
2How Does It Work?
LabubaRAT uses a configuration executed via command-line arguments. This allows attackers to reuse the same binary across different infrastructures. The configuration is stored in a local SQLite database.
3Scans Target Systems
The malware detects installed web browsers and security products. It checks for popular software like Google Chrome, Mozilla Firefox, and Microsoft Defender, and gathers system information.
4Wide Range of Functions
LabubaRAT has various functions including command execution, file upload/download, screenshot capture, and SOCKS5 proxy support. These capabilities provide attackers with extensive control.
5Traces of MaaS Model
There are indications that LabubaRAT is offered under a Malware-as-a-Service (MaaS) model. This suggests that the malware can be used by different attackers.
6Security Alert
LabubaRAT stands out with its Rust-based structure and flexible configuration. Security experts emphasize the need for vigilance and continuous system updates against such malware.
Original article: The Hacker News — LabubaRAT: NVIDIA Yazılımı Gibi Görünen Yeni Bir Zararlı Yazılım