LabubaRAT SQLite Staging Database Creation

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•1•0•1

This rule detects the creation of specific SQLite database files ('nvctr_sys.db', 'nvctr_sys.db-wal', 'nvctr_sys.db-shm') associated with the LabubaRAT malware family. These files are used by the malware to stage collected data locally before exfiltration.