Meet BunnyLoader: The Rapidly Evolving Malware-as-a-Service

In a digital landscape where cyber threats evolve at an alarming pace, security researchers have unveiled a new malware-as-a-service (MaaS) dubbed ‘BunnyLoader.’ This insidious malware has been making waves across the dark corners of the internet, enticing cybercriminals with its fileless loader capabilities and a host of malicious functions, including clipboard theft.

BunnyLoader, a constantly evolving threat, is rapidly gaining notoriety among malicious actors. Since its initial appearance on September 4, this malicious software has seen multiple updates, each introducing new features and addressing bugs. Presently, BunnyLoader can perform a slew of malicious activities, from downloading and executing payloads to keylogging, data theft (including sensitive information and cryptocurrencies), and remote command execution.

Researchers from cloud security company Zscaler have been closely monitoring BunnyLoader’s ascent in the cyber underworld. They note that this malware is becoming increasingly popular among cybercriminals due to its robust feature set, all available at a surprisingly low cost.

BunnyLoader promoted on hacker forum (Zscaler)

BunnyLoader Overview

BunnyLoader’s command and control panel empower even the most amateur cybercriminals to deploy second-stage payloads, engage in keylogging, steal credentials, manipulate clipboards for cryptocurrency theft, and execute remote commands on compromised devices.

Main malware functions directly available through the panel (Zscaler)

Recent research reveals that, upon execution on a compromised system, BunnyLoader establishes persistence by creating a new value in the Windows Registry. It then operates discreetly, conceals its presence, sets a mutex to prevent multiple instances, and registers the victim within the control panel.

Victims listed on the panel (Zscaler)

This malware conducts various checks to ascertain whether it’s running in a controlled environment, promptly issuing a fabricated architecture incompatibility error if it detects one.

In addition to its primary functionalities, BunnyLoader boasts modules designed to pilfer data stored in web browsers (including passwords, credit card details, and browsing history), cryptocurrency wallets, VPNs, and messaging applications. In essence, it operates as a comprehensive information-stealing tool.

All ill-gotten data is meticulously compressed into ZIP archives before being transmitted to the threat actor’s command and control (C2) server.

Data exfiltrated by BunnyLoader (Zscaler)

Remarkably, BunnyLoader supports the deployment of payloads either to the disk or as memory-resident (fileless) executions, utilizing the process hollowing technique.

Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link