Inside the Rabbit Hole: Bunny Loader 3.0 Unveiled
Summary: Unit 42 documented BunnyLoader 3.0, announced by its author "Player" on Telegram on Feb. 11, 2024, with the claim that the malware was "completely redesigned and enhanced by 90%." The new version switches to a single gate.php C2 endpoint, RC4-encrypts HTTP query parameters with a random 32-character key generated at each execution, and splits its stealer, clipper, keylogger and DoS functions into separately downloadable modules.
What's compelling: BunnyLoader has been sold as malware-as-a-service since September 2023 at $250 for lifetime access, with a private version at $350, and its frequent repacking with PureCrypter, UPX and Themida plus filenames mimicking games and apps like Shovel Knight and Notepet is built to slip past signature-based detection.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026