Loading malware…
Campo Loader is a malware loader active since at least 2020 and observed in sustained campaigns during 2021. It is used to retrieve and execute second-stage payloads, including Ursnif/Gozi, Trickbot, and BazarLoader, and has appeared in campaigns associated with broader cybercrime delivery ecosystems such as Prometheus TDS and BazarCall. The malware is named for a distinctive network URI pattern used during its command-and-download workflow.
A documented infection chain uses phishing emails carrying malicious Microsoft Excel documents, including XLSB files, that rely on hidden sheets, Auto_Open execution, encoded payloads, and abuse of native Windows utilities to decode and launch the loader. In observed cases, the document drops and decodes an intermediate DLL, sometimes packed, and executes it through rundll32. Campo Loader then contacts attacker-controlled infrastructure using characteristic URI paths, receives redirects to payload-hosting locations on compromised websites, downloads an additional DLL, and executes the final malware stage. Repeated execution of the same initial sample has been observed to yield different downstream payloads, indicating flexible payload delivery.
Campo Loader primarily targets Windows environments and functions as an intermediary delivery component rather than the final objective. Its operational role in multi-stage intrusion chains makes it useful to financially motivated threat actors for modular malware deployment, while its use of masquerading, encoded content, living-off-the-land binaries, and staged DLL execution contributes to defense evasion and post-compromise payload delivery.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The first one being the detection of DLL execution passing a .png file with its extension. This technique is more and more used and can be approached using the “T1036: Masquerading” and “T1218.011: Signed Binary Proxy Execution: Rundll32/” techniques.
The use of “certutil.exe” to decode the first charge is quite striking and generic enough to be used as a means of detection. Moreover, this approach fits within the Att&CKMITRE matrix, with the “T1140:Deobfuscate/Decode Files or Information” technique.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware loader observed being distributed through campaigns using the Prometheus TDS.
A malware-as-a-service loader used in the BazarCall infection chain to deliver BazarLoader.
A malware loader delivered via malicious Excel XLSB documents that drops and decodes staged payloads using certutil.exe, executes a DLL via rundll32.exe, and downloads a second-stage payload from attacker-controlled infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.