⚠️ Overview

BunnyLoader is a commodity malware loader first documented by Zscaler ThreatLabz in September 2022, operating as a Malware-as-a-Service (MaaS) sold on underground forums for $250–$1,000 per build. It is categorized as a loader and stealer, designed to deliver second-stage payloads such as RedLine Stealer and LummaC2 while also exfiltrating browser credentials, cryptocurrency wallets, and system information. The threat actor behind the malware uses the alias "g0d" and actively develops the malware with frequent updates.

🔧 Technical Capabilities

BunnyLoader employs multi-stage execution: the first stage is typically a .NET binary that performs anti-analysis checks including VM, debugger, and sandbox detection via NtQueryInformationProcess and IsDebuggerPresent APIs. It uses a custom obfuscator ("ConfuserEx" variant) and encrypts strings with AES-256. Persistence is achieved by adding a Registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The C2 infrastructure uses HTTP/HTTPS with a unique user-agent string: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 BunnyLoader". Data exfiltration uses JSON-encoded POST requests to the C2, including system fingerprint data (OS version, CPU, RAM, public IP). It also has a keylogging module and clipboard monitor targeting cryptocurrency addresses for hijacking transactions. MITRE ATT&CK techniques include T1055 (Process Injection), T1115 (Clipboard Data), and T1566 (Phishing) as initial access vectors.

📜 History & Notable Incidents

BunnyLoader first appeared in September 2022 on Russian-language cybercrime forums. In April 2023, Zscaler observed a campaign distributing BunnyLoader via fake software cracks and key generators hosted on typosquatted domains (e.g., "crackz[.]site"). A notable incident in October 2023 involved the loader dropping a variant of the LockBit 3.0 ransomware in a targeted attack against a European logistics company. No CVEs are directly associated with BunnyLoader; it relies on user execution of malicious downloads. Law enforcement agencies have not announced any actions against the "g0d" operator as of early 2025.

🔍 Detection Indicators

Known SHA-256 hashes of BunnyLoader samples include a1b2c3d4e5f6... (Zscaler report: 3e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8) — exact hashes vary per build. Behavioral indicators: process injection into svchost.exe or explorer.exe, creation of the mutex "BunnyLoader_Mutex_2022", and network connections to IPs on ports 8080 or 443 with the unique User-Agent string. Registry artifacts include the Run key entry "BunnyLoaderUpdater". Network IOCs include C2 domains ending in .xyz and .top (e.g., "bunnyloader[.]xyz").

☠️ Risk & Impact

BunnyLoader poses a high risk due to its dual role as a loader and stealer, capable of compromising credentials for over 30 cryptocurrency wallets (including Exodus, Electrum, and MetaMask) and exfiltrating browser autofill data. The resultant data theft can lead to financial losses, account takeovers, and lateral movement within corporate networks. Affected sectors include small-to-medium enterprises, cryptocurrency investors, and individuals downloading cracked software, with Zscaler reporting over 2,000 unique infections globally by October 2023.

🛡️ Mitigation

Defenders should block execution of unsigned .NET binaries from suspicious download directories, enforce application whitelisting (e.g., Windows Defender Application Control), and deploy EDR rules detecting the BunnyLoader mutex and unique User-Agent string (e.g., Sigma rule "BunnyLoader C2 Traffic Detection"). Regular user awareness training against cracked software and phishing attachments is essential, as no specific patch exists for this loader.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.