Loading malware…
Colibri is a Windows malware loader offered as a malware-as-a-service tool and observed since 2021 in underground criminal markets and active delivery chains. Its primary role is to download and execute additional payloads on compromised hosts, including information stealers such as Vidar. Colibri has been associated with campaigns using malicious Microsoft Word documents with remote template injection, and it has also appeared among malware families distributed through broader loader ecosystems such as PrivateLoader. Reported delivery themes include trojanized software and document-based infection chains.
Technically, Colibri is designed to hinder analysis and detection. Reported samples omit a conventional Import Address Table, encrypt strings, use self-modifying code, and dynamically resolve WinAPI functions through hashing and arithmetic operations rather than normal imports. It also uses basic anti-analysis and execution control measures such as mutex creation to prevent multiple instances and delayed execution before network activity.
Colibri communicates with command-and-control infrastructure over encrypted channels and retrieves additional content for execution, with analysis indicating downloaded data may be encrypted and decoded on the host before use. Its persistence tradecraft on Windows includes scheduled-task abuse. A documented technique copies the malware into a user-accessible WindowsApps location under a name that collides with a legitimate PowerShell cmdlet, then uses a scheduled task to invoke PowerShell in a way that causes the malicious executable to run, providing persistence across reboots while reducing visibility. This behavior has been highlighted as a notable example of path interception and scheduled-task-based persistence on Windows 10 and later systems.
Colibri targets Windows systems, including Windows Server, and is best characterized as a stealth-focused loader used to establish footholds and deliver follow-on malware for financially motivated intrusion activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack starts with a malicious Word document deploying a Colibri bot that then delivers the Vidar Stealer... The latest findings come as cybersecurity company Trustwave last month detailed an email-based phishing campaign that leverages Microsoft Compiled HTML Help (CHM) files to distribute the Vidar malware...
It achieves this by creating a scheduled task on systems running Windows 10 and above, with the loader executing a command to launch PowerShell with a hidden window (i.e., -WindowStyle Hidden) to conceal the malicious activity from being detected.
It achieves this by creating a scheduled task on systems running Windows 10 and above, with the loader executing a command to launch PowerShell with a hidden window (i.e., -WindowStyle Hidden) to conceal the malicious activity from being detected.
An attacker can obtain persistence by hijacking the PowerShell cmdlet 'Get-Variable' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path. Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run.
All the strings in the loader as well as the connection channel between the C2 server and the loader are encrypted.
To avoid detection by AVs statically, the payload’s author hashes all WinAPI functions, ignoring the Import Address Table (IAT)... The payload resolves the function names dynamically using XOR and Shift operations.
...dropping its own copy to the location "%APPDATA%\Local\Microsoft\WindowsApps" and naming it "Get-Variable.exe."
The payload calls the function CryptStringToBinary, to decrypt data after downloading the data from the C2 server, which indicates that the data could be encrypted.
The campaign attack chain observed by Malwarebytes takes advantage of a technique called remote template injection to download the Colibri loader ("setup.exe") by means of a weaponized Microsoft Word document.
Before running on the system, the payload creates a mutex by calling the function CreateMutexW and then tests if there is an instance of the payload already running on the infected system.
If there is no instance of the payload running on the system, the payload continues the execution and calls the Sleep function to sleep for 3 seconds as a simple way to evade protection.
...executing a command to launch PowerShell with a hidden window (i.e., -WindowStyle Hidden) to conceal the malicious activity from being detected.
An attacker can obtain persistence by hijacking the PowerShell cmdlet 'Get-Variable' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path. Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run.
Threat hunters often focus on spotting command-and-control (C2) servers, open directories typically identified by the phrase “Index of” and phishing components.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with persistence by hijacking the PowerShell cmdlet 'Get-Variable' via a malicious Get-Variable.exe placed in the WindowsApps folder, causing execution when PowerShell is opened via a scheduled task.
Named malware/tool listed as detectable via SHA-256 hash in a compilation of attacker infrastructure and malware-related indicators.
A malware family observed as one of the payloads distributed by PrivateLoader.
Malware noted for using scheduled tasks as a persistence mechanism to survive reboots and execute malicious payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.