LabubaRAT Rust Implant + Multi-Stage Phishing Relay Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack

---
title: LabubaRAT Rust RAT Execution - Fake NVIDIA Binary
id: 7f3a9c21-8b2e-4d1a-9e5f-labuba000001
status: experimental
description: Detects execution of binaries masquerading as NVIDIA software with mismatched signature/metadata, or execution of known LabubaRAT hashes. LabubaRAT is a Rust-based RAT using fake NVIDIA metadata.
author: Security Arsenal Threat Intelligence
date: 2026/08/13
references:
    - https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/
logsource:
    category: process_creation
    product: windows
selection_hashes:
    - Hashes|contains:
        - '8c4e4804f21649e5ddc6a5670f3b3828a43bff304f02f184f9842c2569570f3d'
        - 'b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328'
        - 'd8bf355a198fb5db3ea65cfdfcdfbd19'
selection_nvidia_masquerade:
    OriginalFileName|contains:
        - 'nvidia'
        - 'nvcontainer'
        - 'nvsvc'
    Image|contains:
        - '\Downloads\'
        - '\Temp\'
        - '\AppData\Local\Temp\'
        - '\Users\Public\'
selection_unsigned:
    - Signed: 'false'
condition: selection_hashes or (selection_nvidia_masquerade and selection_unsigned)
falsepositives:
    - Legitimate NVIDIA installer updates running from temp (signed binaries)
level: high
tags:
    - attack.execution
    - attack.t1036
    - attack.t1059
---
title: LabubaRAT DNS Tunneling C2 - High Entropy DNS Queries
id: 7f3a9c21-8b2e-4d1a-9e5f-labuba000002
status: experimental
description: Detects DNS queries to known LabubaRAT C2 domain pipicka.xyz and anomalous long-label/high-volume DNS query patterns consistent with DNS tunneling exfiltration.
author: Security Arsenal Threat Intelligence
date: 2026/08/13
references:
    - https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/
logsource:
    category: dns
selection_known_c2:
    query|contains:
        - 'pipicka.xyz'
selection_tunnel_pattern:
    query|re: '.{60,}\.[a-z0-9-]+\.(xyz|top|shop|com|net)'
filter_common:
    query|contains:
        - 'microsoft.com'
        - 'windowsupdate.com'
        - 'google.com'
        - 'cloudflare.com'
condition: selection_known_c2 or (selection_tunnel_pattern and not filter_common)
falsepositives:
    - CDNs and telemetry services with long encoded subdomains
    - Security tools using DNS-based callback
level: high
tags:
    - attack.command_and_control
    - attack.t1071.004
    - attack.t1048
---
title: Phishing HTML Smuggling Followed by Browser-Spawned Script Execution
id: 7f3a9c21-8b2e-4d1a-9e5f-phish0000003
status: experimental
description: Detects browser processes (Chrome/Edge/WebView2) spawning script interpreters or Office processes, consistent with HTML smuggling payload detonation seen in multi-stage phishing chains abusing Cloudflare Workers and Framer.
author: Security Arsenal Threat Intelligence
date: 2026/08/13
references:
    - https://www.levelblue.com/blogs/spiderlabs-blog/the-infrastructure-relay-inside-multi-stage-phishing-redirection-chains
logsource:
    category: process_creation
    product: windows
selection_parent_browser:
    ParentImage|endswith:
        - '\chrome.exe'
        - '\msedge.exe'
        - '\firefox.exe'
        - '\msedgewebview2.exe'
        - '\brave.exe'
selection_child_payload:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wscript.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\rundll32.exe'
        - '\regsvr32.exe'
        - '\cmd.exe'
condition: selection_parent_browser and selection_child_payload
falsepositives:
    - Browser extensions with native messaging hosts (rare for script interpreters)
    - Enterprise SSO plugins
level: high
tags:
    - attack.initial_access
    - attack.t1566.002
    - attack.t1027.006
    - attack.t1204.002

// LabubaRAT + Multi-Stage Phishing Infrastructure Hunt — Microsoft Sentinel
// Coverage: C2 DNS, phishing redirection domains, browser-spawned script execution, NVIDIA masquerade
let lookback = 14d;
let phishing_domains = dynamic(["alasilla.com", "2934523t5234535323973294afhdsfga.com", "bl.dase7.shop", "dase7.shop", "pipicka.xyz"]);
let rat_hashes = dynamic(["8c4e4804f21649e5ddc6a5670f3b3828a43bff304f02f184f9842c2569570f3d", "b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328"]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (phishing_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType, HuntStage="Network-to-Known-IOC"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 has_any (rat_hashes) or MD5 == "d8bf355a198fb5db3ea65cfdfcdfbd19"
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, HuntStage="LabubaRAT-Hash-Match"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","msedgewebview2.exe")
    | where FileName in~ ("powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","cmd.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, HuntStage="HTML-Smuggling-Execution"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any ("nvcontainer","nvsvc","nvidia") or ProcessVersionInfoProductName has "NVIDIA"
    | where FolderPath has_any ("\\Downloads\\","\\Temp\\","\\AppData\\","\\Users\\Public\\")
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, HuntStage="NVIDIA-Masquerade-Suspicious-Path"
    )
| sort by TimeGenerated desc

# LabubaRAT & Phishing-Relay Host Hunt — Security Arsenal
# Checks persistence artifacts, suspicious NVIDIA-masquerading binaries, DNS cache hits, and network connections
# Run elevated. Output: CSV per host for triage.

$report = @()
$c2Domains = @('pipicka.xyz','alasilla.com','bl.dase7.shop','dase7.shop','2934523t5234535323973294afhdsfga.com')
$ratHashes = @('8c4e4804f21649e5ddc6a5670f3b3828a43bff304f02f184f9842c2569570f3d',
               'b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328')

Write-Host '[*] Checking persistence locations for NVIDIA-masquerading entries...' -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match 'nvidia|nvcontainer|nvsvc' -and $val -match 'AppData|Temp|Public|Downloads') {
                $report += [PSCustomObject]@{Type='Persistence-RunKey'; Artifact="$key :: $($_.Name) = $val"; Severity='HIGH'}
            }
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'AppData|Temp|Public' -and ($_.TaskName -match 'nv|nvidia|display|driver' -or $_.Actions.Execute -match 'nv') } | ForEach-Object {
    $report += [PSCustomObject]@{Type='Persistence-ScheduledTask'; Artifact="$($_.TaskName) -> $($_.Actions.Execute)"; Severity='HIGH'}
}

Write-Host '[*] Hashing suspicious NVIDIA-named binaries outside System32...' -ForegroundColor Cyan
$searchPaths = @("$env:LOCALAPPDATA","$env:APPDATA","$env:TEMP","C:\Users\Public","C:\ProgramData")
foreach ($p in $searchPaths) {
    Get-ChildItem $p -Recurse -Include '*nvidia*','*nvcontainer*','*nvsvc*' -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        $sev = if ($ratHashes -contains $h.ToLower()) {'CRITICAL — KNOWN LABUBARAT HASH'} else {'MEDIUM'}
        $sig = Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue
        if ($sig.Status -ne 'Valid' -or $sev -like 'CRITICAL*') {
            $report += [PSCustomObject]@{Type='Masquerade-Binary'; Artifact="$($_.FullName) | SHA256:$h | Sig:$($sig.Status)"; Severity=$sev}
        }
    }
}

Write-Host '[*] Checking DNS cache and active connections for C2/phishing domains...' -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $c2Domains) {
    $dnsCache | Where-Object { $_.Entry -like "*$d*" } | ForEach-Object {
        $report += [PSCustomObject]@{Type='DNS-Cache-Hit'; Artifact="$($_.Entry) -> $($_.Data)"; Severity='CRITICAL'}
    }
    Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
        try { $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName } catch { $rdns = $null }
        if ($rdns -and $rdns -like "*$d*") {
            $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
            $report += [PSCustomObject]@{Type='Active-C2-Connection'; Artifact="$proc (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort) [$rdns]"; Severity='CRITICAL'}
        }
    }
}

Write-Host '[*] Flagging WebView2 runtime anomalies (LabubaRAT webview2 component)...' -ForegroundColor Cyan
Get-Process msedgewebview2 -ErrorAction SilentlyContinue | ForEach-Object {
    $parent = (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.Id)").ParentProcessId
    $pname = (Get-Process -Id $parent -ErrorAction SilentlyContinue).ProcessName
    if ($pname -notin @('explorer','Teams','msedge','OUTLOOK','WidgetBoard','SearchHost')) {
        $report += [PSCustomObject]@{Type='WebView2-Anomaly'; Artifact="msedgewebview2 PID $($_.Id) spawned by $pname (PID $parent)"; Severity='MEDIUM'}
    }
}

if ($report.Count -gt 0) {
    $report | Sort-Object Severity | Format-Table -AutoSize
    $report | Export-Csv -Path ".\LabubaRAT_Hunt_$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) finding(s) exported to CSV. Escalate CRITICAL items immediately." -ForegroundColor Red
} else {
    Write-Host '[+] No indicators of LabubaRAT or phishing-relay compromise found on this host.' -ForegroundColor Green
}