EvilBunny
Software · ATTACK:enterprise:S0396
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0396",
"title": "EvilBunny",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0396",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a8a778f5-0035-4870-bb25-53dc05029586",
"external_id": "S0396",
"domain": "enterprise",
"created": "2019-06-28T17:40:32.217Z",
"modified": "2024-08-05T18:21:34.265Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "EvilBunny"
},
{
"source_name": "Cyphort EvilBunny Dec 2014",
"url": "https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00ba134e-1833-4dde-bf4e-7ec45271e8a6
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0109ee05-c2a9-4dcf-80d1-f859500c97c9
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--030958f2-615b-4c80-a1ec-38ed335da413
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ab3e47c-29f4-4c17-b84b-609a91086653
Cyphort EvilBunnyATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c3f8b3b-a6a3-472c-b792-6f5c7ccfbb24
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e11828-0e27-4eb6-afb6-5c048ae9189b
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--265686ee-6e90-439f-9966-e40b8472bd06
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ce1ed77-dc5d-42d8-838e-b927dc6d6afb
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66cadf3d-bfb7-4b75-a659-06b3cb1bbd37
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cae93fc-8ba7-462f-a27d-b9b8c289034e
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9aebf2b6-7688-4946-a12e-ea1d8e62e158
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad3eb54c-0f67-42b8-b4cf-060ab6057b79
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b29637f2-49be-4785-b82b-09661f25c42c
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2753d61-40d9-45b3-884a-a4c63b1da476
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e900ada7-1b3a-442d-aa86-5cd16a3a2c00
Cyphort EvilBunny Dec 2014