Malware: EvilBunny

Description

[EvilBunny](https://attack.mitre.org/software/S0396) is a C++ malware sample observed since 2011 that was designed to be a execution platform for Lua scripts.(Citation: Cyphort EvilBunny Dec 2014)

External References

• mitre-attack
• Cyphort EvilBunny Dec 2014

Techniques Used by This Malware

• T1047 — Windows Management Instrumentation
• T1053.005 — Scheduled Task
• T1057 — Process Discovery
• T1059.003 — Windows Command Shell
• T1059.011 — Lua
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1106 — Native API
• T1124 — System Time Discovery
• T1203 — Exploitation for Client Execution
• T1497.001 — System Checks
• T1497.003 — Time Based Evasion
• T1518.001 — Security Software Discovery
• T1547.001 — Registry Run Keys / Startup Folder