Researchers discover how Colibri malware persists on compromised systems

Cybersecurity researchers have described a simple but effective persistence mechanism adopted by a relatively new malware loader called Colibri, which has been observed deploying a Windows information stealer known as Vidar as part of a new campaign.

"The attack starts with a malicious Word document that deploys a Colibri bot, which then delivers the Vidar Stealer," Malwarebytes Labs reported in an analysis. "The document contacts a remote server at securetunnel[.]co to load a remote template named trkal0.dot, which interacts with a malicious macro," the researchers added.

First documented by FR3D.HK and Indian cybersecurity company CloudSEK earlier this year, Colibri is a malware-as-a-service (MaaS) platform designed to drop additional payloads on compromised systems. The first signs of the loader appeared on Russian underground forums in August 2021.

"This loader has several techniques that help it evade detection," CloudSEK researcher Marah Aboud noted last month. "These include omitting the IAT (Import Address Table), together with encrypted strings to make analysis more difficult."

The campaign's attack chain observed by Malwarebytes exploits a technique called remote template injection to download the Colibri loader (setup.exe) through a weaponised Microsoft Word document.

The loader then uses a previously undocumented persistence method to survive machine restarts, after placing a copy of itself in %APPDATA%\Local\Microsoft\WindowsApps and naming it Get-Variable.exe.

It achieves this by creating a scheduled task on systems running Windows 10 and later, with the loader executing a PowerShell launch command in a hidden window (-WindowStyle Hidden) to conceal the malicious activity.

"Get-Variable is a legitimate PowerShell cmdlet — a lightweight command used in the Windows PowerShell environment — that retrieves the value of a variable in the current console," the researchers explained.

However, because PowerShell runs in the WindowsApps path by default, the command issued when creating the scheduled task causes the malicious binary to execute instead of its legitimate counterpart.

This essentially means that an adversary can easily achieve persistence by combining a scheduled task with any payload, provided it is named Get-Variable.exe and placed in the appropriate location, the researchers said.

The latest findings come as cybersecurity company Trustwave described an email-based phishing campaign last month that uses Microsoft Compiled HTML Help (CHM) files to distribute Vidar malware in an attempt to go unnoticed.