BunnyLoader

BunnyLoader is a multi-module malware loader/infostealer that establishes persistence via a Run registry value, employs anti-VM and sandbox checks, registers with a C2 (37.139.129.145) using distinct user-agents, and supports modules for credential and wallet theft, clipboard hijacking (clipper), keylogging, downloader (disk and fileless via process hollowing), and remote command execution; stolen data is archived and exfiltrated to the actor's HTTP endpoints.