The name EvilBunny is derived from debug information embedded in the malware’s dropper. Furthermore, the specified piece incorporates a Lua 5.1 interpreter, which allows the malware to execute Lua scripts and change its behavior at runtime. The dropper will place the EvilBunny malware under %APPDATA%\Perf Manager\ or %WINDIR%\msapps\; depending whether the dropper is running with administrative privileges or not. Also, the malware will generate numerous files to help its execution and frequently reply back to the C&amp;C with status messages. Similar to its dropper, the binary seeks to evade sandboxes. Next to that, the main thread also runs sub threads to maintain log files the malware creates during execution and to keep track of the overall system load the malware creates. The worker threads are internally dubbed ‘hearer’, which is believed to stand for ‘listener’. It can be concluded thereafter that the malware authors were no English native speakers. The main action of the malware is carried out in the main thread, which parses commands and executes Lua scripts, provided by the worker threads via command files. Each hearer has a dedicated method to receive instructions which is either separately via HTTP from the server, aggregated through a downloaded data file or as tasks to be configured as scheduled tasks. In general this is a rather uncommon technique, but it has been observed before, especially in connection with some adware variants