SB/BadBunny-A is a multi-platform worm written in several scripting languages and distributed as an OpenOffice.org document containing a StarBasic macro.
SB/BadBunny-A spreads by dropping malicious script files that affect the behavior of the popular IRC programs mIRC and X-Chat, causing them send SB/BadBunny-A to other users. These malicious script files are named badbunny.py (for XChat) and script.ini (for mIRC, overwriting the existing mIRC file) and are also detected as SB/BadBunny-A.
SB/BadBunny-A drops different additional components depending on the platform on which it is running:
- On Windows, it drops a file named badbunny.js that is a JavaScript file infector also detected as SB/BadBunny-A.
- On Linux, it drops a file named badbunny.pl that is a Perl file infector also detected as SB/BadBunny-A.
- On MacOS, it drops one of two possible files named badbunny.rb and badbunnya.rb that are Ruby file infectors also detected as SB/BadBunny-A.