GDI32 Module Load by nvidia-sysruntime.exe (LabubaRAT Screenshot Capture)

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•1•0•1

Detects the LabubaRAT implant (nvidia-sysruntime.exe) loading gdi32.dll, consistent with its screenshot capture routine which uses GetDC, CreateCompatibleBitmap, BitBlt (SRCCOPY), and GetDIBits to capture the desktop and return a base64-encoded JPEG to the attacker.