LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems

A previously undocumented Rust-based remote access trojan, dubbed LabubaRAT, which masquerades as legitimate NVIDIA software to establish persistent access on Windows systems.

The malware was identified by the company’s Adversary Pursuit Group (APG) and appears designed as a reusable, panel-managed framework rather than a single-purpose payload.

The observed sample, named nvidia-sysruntime.exe, impersonates an NVIDIA Container Runtime component through its version metadata, debug artifacts, mutex naming, and local database files.

It includes references to “NVIDIA Corporation,” “NVIDIA Container Runtime Monitor,” and “NVIDIA Container Toolkit,” and creates a single-instance mutex named Local\NVIDIAContainerMonitor_SingleInstance.

These artifacts could allow the implant to blend into environments where NVIDIA software is commonly installed.

Despite the NVIDIA branding, the unsigned 646464-bit Windows GUI executable is a Rust-built backdoor.

Researchers found a compile timestamp of June 171717, 202620262026, alongside Rust build-path artifacts referencing C:\Users\funt\.cargo\registry… and a nvidia_container.pdb debug path.

The technical evidence indicates that the NVIDIA identity was deliberately constructed to disguise a fully capable remote access implant.

LabubaRAT’s name originates from its command-and-control infrastructure. The observed C2 domain, pipicka[.]xyz, exposed a page title labeled LabubaPanel and used a Labubu-themed favicon.

Unlike conventional malware with a hardcoded C2 address, LabubaRAT accepts deployment-time configuration.

Operators can supply an organization identifier, API key, server URL, group tag, device name, polling interval, and DNS settings through command-line parameters or environment variables prefixed with ZM_.

It also supports a –b parameter that decodes Base64-encoded runtime arguments, allowing threat actors to conceal configuration values in persistence commands.

In the observed case, the encoded configuration identified the organization as luxespa, the campaign group as rabbit, and the C2 server as hxxps[://]pipicka[.]xyz.

This model enables operators to reuse the same compiled binary across campaigns while changing infrastructure and victim grouping without rebuilding the malware.

Blackpoint Cyber’s Adversary Pursuit Group (APG) said in a report shared with GBhackers, identified additional German-hosted C2 servers sharing the same panel characteristics, suggesting a wider infrastructure rollout beginning in early June.

Its local state includes server URLs, device tokens, DNS parameters, polling intervals, and host identifiers.

LabubaRAT Rust Malware

Before receiving tasking, LabubaRAT profiles infected endpoints by collecting hostname, CPU model, memory, IP address, domain membership, UAC status, browser inventory, and installed security software.

Its security-product discovery routine checks common uninstall registry locations and looks for products including Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro.

This reconnaissance can help operators tailor their next actions to the endpoint’s defensive posture.

LabubaRAT supports three communication channels: standard HTTPS polling, Microsoft WebView2-backed communication, and DNS tunneling.

The RAT stores enrollment and operational data in a SQLite database called nvctr_sys.db, reinforcing its NVIDIA-themed camouflage.

The WebView2 functionality uses embedded JavaScript and browser-context fetch() requests, while the DNS module supports payload chunking, Base32 decoding, resolver configuration, and timeout handling.

These alternatives give operators fallback options when direct web-based C2 traffic is blocked or monitored.

The malware’s tasking capabilities include Windows command shell, PowerShell, and JavaScript execution; screenshot capture through Windows GDI APIs; file upload, download, deletion, archiving as well as SOCKS5 proxy support.

The JavaScript handler uses temporary wupd_-prefixed files and Windows Script Host, potentially providing an alternative execution route where PowerShell is more heavily monitored.

LabubaRAT also supports user-level persistence through the HKCU\Run registry key. Combined with Base64-wrapped startup parameters, this allows the backdoor to retain its configuration and restart after user logon.

The discovery highlights how Rust-based malware continues to mature into flexible, multi-transport frameworks.

Defenders should investigate suspicious NVIDIA-named binaries, monitor unusual HKCU\Run entries, review DNS anomalies, and hunt for artifacts including nvidia-sysruntime.exe, nvctr_sys: db, Local\NVIDIAContainerMonitor_SingleInstance, and LabubaPanel-associated infrastructure.

Indicators of Compromise

Type	Indicator	Context
File name	nvidia-sysruntime.exe	Analyzed Windows executable
SHA-256	b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328	Analyzed LabubaRAT sample
MD5	d8bf355a198fb5db3ea65cfdfcdfbd19	Analyzed LabubaRAT sample
PDB path	nvidia_container.pdb	Debug path artifact
Build path username	C:\Users\funt\.cargo\registry\…	Rust build path artifact
Mutex	Local\NVIDIAContainerMonitor_SingleInstance	Single instance mutex
Local database	nvctr_sys.db	SQLite local state database
C2 URL	hxxps://pipicka[.]xyz	Observed configured server
IP Address	191.44.109[.]130	Identified related infrastructure
IP Address	87.120.108[.]18	Identified related infrastructure
IP Address	168.222.254[.]204	Identified related infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide