02334daf187aa319b3b2aef1608737b6770d5dd04be8e65bff4c6ff3adef613d

Sharing

Copy URL Twitter E-mail

General

Target
Bunni Executor V.6.6.3 (MINOR UPDATE).zip
Size 117.2MB
Sample260803-cja92swelh
SHA256 02334daf187aa319b3b2aef1608737b6770d5dd04be8e65bff4c6ff3adef613d
MD5 5d4574c9cbe29c6966b848e4a1e3b61d
SHA1 673be84b1f55614f85f2ff8f9e78513a892cc9e1
SHA512 caa52a0bd49291f5ebf08385ab2d45af77847b19ebdd6cec3e7d9b2954fce62b56f6ee361a93ed4b70eb58ec1cf46060ad9fd5371c1a8d9b90ae3f18bc1866f7
SSDEEP 3145728:Q0PkS0Pkn0Pk24GFbvOUbEH8QI2J3GJpwdRGJwORaPsGMbmGfy0PkV8:Yu1wbvEHjI2JtGJVRASmGfO6
TLSH
T1EB48330496905E35E099F1BEFFF92CF164A51B8B2251E39F623287BBE9EC2745137024
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/BunniExecutor.exe
- Size 7.2MB
- SHA256 da9037ccf6a15dd9471550a6375f7d133aaf49217cdb0f8ce4b8b2ecff592d6b
- MD5 9d19118dffb4d37cb5c37236aaaa74fe
- SHA1 38752f9971a29ffa2c2c46b3cdc468ea5c601c8b
- SHA512 9a09ad9ce45dc88aa52d3a695f21ed790823f56379cea4c389829369b89f794cadb8dee42e9c9f8b42c4105db484c00904402dc80a702bcd8c0857f9f1b69b8f
- SSDEEP 196608:31stZxs0urHeD9BKG+5fc2S/ErXKEtw+GoH8MsqfTmd:3itZu0uyDvV+53SM8+HzD+
- TLSH
  T1B77600046788DFDBF591E1358649AA1092D2B9FF1E1387A6B3A004F5382B38D5B2DDCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/api/FLDevice.dll
- Size 4.5MB
- SHA256 240c45daea96b016c4c8f7f777232adf7f4ca1195a8499e4ac558f063c5c2d9f
- MD5 4f08ff3fd19ee2595552cf60317bbd71
- SHA1 1407d149458208cf847a4517934408bb3b6c3ba2
- SHA512 85a3bd98d5ff3cdfe1f3b4875168b22820eecfc27159ddb6b6c760e45d558021c40c8db135aee38967783ae020dd3127040f4612caac8a903729a43ede8a8188
- SSDEEP 98304:uhNyuMg/G3xIGOHnJj2aTrBF/649cYWy0gNJKu/1i:bIVF7TrBF/649cYWy0gGak
- TLSH
  T134269E32F2A911E8D57AD138DE874D07E772B85903206BDB12D44AA62F63FE05B7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/api/RBXNetwork.dll
- Size 4.5MB
- SHA256 240c45daea96b016c4c8f7f777232adf7f4ca1195a8499e4ac558f063c5c2d9f
- MD5 4f08ff3fd19ee2595552cf60317bbd71
- SHA1 1407d149458208cf847a4517934408bb3b6c3ba2
- SHA512 85a3bd98d5ff3cdfe1f3b4875168b22820eecfc27159ddb6b6c760e45d558021c40c8db135aee38967783ae020dd3127040f4612caac8a903729a43ede8a8188
- SSDEEP 98304:uhNyuMg/G3xIGOHnJj2aTrBF/649cYWy0gNJKu/1i:bIVF7TrBF/649cYWy0gGak
- TLSH
  T134269E32F2A911E8D57AD138DE874D07E772B85903206BDB12D44AA62F63FE05B7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/api/RobloxPlayerBeta.dll
- Size 4.5MB
- SHA256 240c45daea96b016c4c8f7f777232adf7f4ca1195a8499e4ac558f063c5c2d9f
- MD5 4f08ff3fd19ee2595552cf60317bbd71
- SHA1 1407d149458208cf847a4517934408bb3b6c3ba2
- SHA512 85a3bd98d5ff3cdfe1f3b4875168b22820eecfc27159ddb6b6c760e45d558021c40c8db135aee38967783ae020dd3127040f4612caac8a903729a43ede8a8188
- SSDEEP 98304:uhNyuMg/G3xIGOHnJj2aTrBF/649cYWy0gNJKu/1i:bIVF7TrBF/649cYWy0gGak
- TLSH
  T134269E32F2A911E8D57AD138DE874D07E772B85903206BDB12D44AA62F63FE05B7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/api/libBook.dll
- Size 4.0MB
- SHA256 854067efb2cb77b07c7c2eb90faed5ddc6fae186d8a57690b88eb01e7774dde4
- MD5 32037feb1fa30ded0de608f6097bd2fe
- SHA1 3d3db61661b04f16c3a9b64665154319abf6da7e
- SHA512 1e179d07aaecc0a96b509a1c5ab012e9cd99aafbd501f04bacf1356e82709cb8d1db41cbb900db9650f1e7d37853f5d2cf77a9ee06e6c75d91dfe110cb604063
- SSDEEP 98304:0u/DE2qryhoCso+wMcLgPPc1QeKhNKu/Qdh:0cDE2MyuCso+wMcLgPPc1QTwaQz
- TLSH
  T1E4168E32E6A811F8C677D079DD5B5E03E7B1B85903606BEB12944A661F63FE01B3E390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/api/libDjb.dll
- Size 4.0MB
- SHA256 854067efb2cb77b07c7c2eb90faed5ddc6fae186d8a57690b88eb01e7774dde4
- MD5 32037feb1fa30ded0de608f6097bd2fe
- SHA1 3d3db61661b04f16c3a9b64665154319abf6da7e
- SHA512 1e179d07aaecc0a96b509a1c5ab012e9cd99aafbd501f04bacf1356e82709cb8d1db41cbb900db9650f1e7d37853f5d2cf77a9ee06e6c75d91dfe110cb604063
- SSDEEP 98304:0u/DE2qryhoCso+wMcLgPPc1QeKhNKu/Qdh:0cDE2MyuCso+wMcLgPPc1QTwaQz
- TLSH
  T1E4168E32E6A811F8C677D079DD5B5E03E7B1B85903606BEB12944A661F63FE01B3E390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/Decompiler.exe
- Size 9.8MB
- SHA256 1f7bd7cc1814c758c37b63494ff54245f43af2e55dbabd723f98a98f925ca8a4
- MD5 29eb03ee0c2dac349c70bbfc9aa89c58
- SHA1 9a2a628a6901e1ea6d494238ebd48a3145c61d06
- SHA512 bcd4924498c979992af6e58ab41f742b4fede65ea31c989bdad48cb312812e6282c81ae0175cee521af75f82f81ba1b35e329ccae4d6920ac657a67593f38fe4
- SSDEEP 49152:+rTJ4LsCGpGiuRkCYgfwV+yFHyPokZwueBHbGhHEzdnxQ64PszHHnkAaSe4mDXhS:ReS9TBcvMtJmmcsLe9CzmvpEHvYjv
- TLSH
  T1AFA6C716A77960D9D1BBC078D2839F22BD21749907397BF749D1826A2F20EF86D3D324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/RobloxPlayerBeta.dll
- Size 4.5MB
- SHA256 240c45daea96b016c4c8f7f777232adf7f4ca1195a8499e4ac558f063c5c2d9f
- MD5 4f08ff3fd19ee2595552cf60317bbd71
- SHA1 1407d149458208cf847a4517934408bb3b6c3ba2
- SHA512 85a3bd98d5ff3cdfe1f3b4875168b22820eecfc27159ddb6b6c760e45d558021c40c8db135aee38967783ae020dd3127040f4612caac8a903729a43ede8a8188
- SSDEEP 98304:uhNyuMg/G3xIGOHnJj2aTrBF/649cYWy0gNJKu/1i:bIVF7TrBF/649cYWy0gGak
- TLSH
  T134269E32F2A911E8D57AD138DE874D07E772B85903206BDB12D44AA62F63FE05B7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/builder.bat
- Size 133B
- SHA256 ac5338a7229789f2987a4158fe22ba844d84991fc08318bd537c773765acd866
- MD5 1ff3d20cdbe5f2babb8fbf2319b7e713
- SHA1 4b2632341c0b74ce5cdfd3dcf69996e5d455d520
- SHA512 e82c611adf2f4f32d12008f1ac83241779421d26a15654bc208fa7385b46c3507d202d4b464a01b4b7e0cec69b23c8ee8ea8481bb5a47cb0bad33e144fa4422f
- TLSH
  T15CC09B41B807021715131C915C567D937A0F6487F400D290B541A559CAEF6C1B7EDEDC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral17 behavioral18
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/data2/4dXkfl.dll
- Size 168KB
- SHA256 060271ff8c1f9ba872193df11ba1e088993e9ae015bb32cead7f624431e37129
- MD5 d6be3eccaf7c505a0e5baff0eda89f83
- SHA1 08e16cb97e9fcfc3bbb3785b78e1a8cd7687bcb6
- SHA512 2d1c31700b193e87447b7c5096ce2ee5350ffae4e16405722d3d7eeb225a2e9e8a9fecb4e2acdbeac5e1f9a4031ad7a99acbfe472071d4cbe49efe2974eea87c
- SSDEEP 192:GtwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwB:D
- TLSH
  T11FF3246B981453049A63BD295AC3DB6C01CAC9A9D3DAE344850457FFBA20318F37F9DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/data2/A0xfjB.dll
- Size 81KB
- SHA256 eb15c13d499c777a9d70f47f9dc0ce5a83bd4ee836b10f7d11070adbbe046593
- MD5 96d84d5cd6e0ec21b10eb0d5f74296a3
- SHA1 4b5ade21de5c19ce8f55bbccfda79ccc993bd590
- SHA512 0ea3b18239a8dff91751ebbb621143b8dc8ca704196850ca3f7c5e749a0a07547a1dd87a7633f9b93e53c92b0e33b48689cc3ecd369afa4358439add4a62ac2f
- SSDEEP 192:GtwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwtA5ptwJ:n
- TLSH
  T17583246B981453049A63BD295AC3DB6C01CAC9A9D3DAE344850457FFBA20318F37F9DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/data2/Bunni.exe
- Size 17.0MB
- SHA256 2f497826c1fb5542ea596f4894a850d5767aba4dc0886db20234a1c86894ed80
- MD5 a59f6560e77dc252230ef4f2d9f7883e
- SHA1 50325829ab7b75aa2b0caf735b58e076736780e0
- SHA512 617c39b56c933b4fd9cb22607c862e1b33ea89489ec62d60a9ea8d2fae55d8a7b3d3685ac53df24cd914d16ab8408cdb7cbed33863d0ddd3ddba93842f454c0b
- SSDEEP 196608:AcIzBf/aNuO+FrFTzrAG0t56mWXT4PJ+rUE:RIzBfYIFrlz8G0PVWMPPE
- TLSH
  T1AF070720BB9B9A6DD05BC4B0834B86764D3174CB0B35B9BF448492382F79BF46F38659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral23 behavioral24
- Target
  Bunni Executor V.6.6.3 (MINOR UPDATE)/bin/data2/BunniexecutorSetup.exe
- Size 86.0MB
- SHA256 ef98b05b4c5e5587bf40590d5c4c220a2f70e584f2c03cf25a1c9dc227b15e23
- MD5 7e79a87529b391d27d61b5f56e80f39c
- SHA1 c17fd077dd5a1b7da971fc63c763c4ce48e827e4
- SHA512 f123a3385a31a6d7c1997d9af7acfab01d40e2126c68c289507e66262cc0a4cbfcb6d1ddd077206c8b2991678072190ebbb4eaa3399c9c0a96035e331a9fb87a
- SSDEEP 1572864:6J+BWMFDe45kRwB2W6hDR11v5HK0GaZFMbMqIdlJI1lln34GVDwB24pa7dO2S:6gBFle45APJhDRz5HKPD2dlE34GhwB2K
- TLSH
  T166183359ADC0AE17DD89B17DABFD6AE56895AD0B3554E35F22314C2FA2FCA30C231430
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32