{
  "family": "kolabc",
  "sample_count": 143,
  "category": "worm",
  "description": "Worm:Win32/Kolabc (commonly identified across threat telemetry as Trojan.Kolabc, Worm.Win32.Kolab, or Win32/Kolabc) is a resilient, self-propagating Windows network worm and botnet agent. Operating as a modular malware platform, Kolabc propagates across local network subnets by searching for unprotected SMB shares and infecting removable storage devices (USB thumb drives) via crafted autorun.inf files and weaponized LNK shortcuts. Once installed on a victim workstation, Kolabc injects malicious threads into trusted system processes such as svchost.exe or explorer.exe, establishes persistence via the Windows Run registry keys, and connects to remote IRC or HTTP command-and-control infrastructure. Controlled endpoints receive commands to download secondary malware payloads—including banking trojans and ransomware—relay spam emails, or launch coordinated distributed denial-of-service (DDoS) flood attacks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Kolabc",
    "Worm:Win32/Kolabc",
    "Trojan.Kolabc",
    "Worm.Win32.Kolab",
    "Win32/Kolabc",
    "Kolab Worm",
    "Worm:Win32/Kolab"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Kolabc malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kolabc is a network worm and botnet client that spreads via USB drives and network shares, allowing attackers to execute commands, launch DDoS attacks, and download secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kolabc propagate across systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kolabc infects removable flash drives with autorun.inf scripts and weaponized shortcuts, and scans local subnets for open or poorly secured SMB network shares."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious tasks does a Kolabc botnet perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Compromised systems participate in distributed denial-of-service (DDoS) attacks, relay massive spam email volumes, and download auxiliary banking Trojans or ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kolabc evade security monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kolabc injects its payload code into legitimate Windows processes like svchost.exe and explorer.exe, masking its network traffic within standard operational activities."
      }
    },
    {
      "@type": "Question",
      "name": "How do organizations remediate Kolabc infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Organizations should disable USB autorun, enforce network segmentation on SMB ports 445/139, run endpoint anti-malware scans, and rotate local administrator credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1021.002",
    "T1055",
    "T1071.001",
    "T1489",
    "T1547.001",
    "T1498"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Kolabc payload and its C2 configuration.",
    "Audit the Windows Task Scheduler, Registry Run keys, and Windows Services to identify and remove the Kolabc persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force global password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on static file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Botnet Operations",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2009,
  "actor": "Cybercrime Botnet Operators",
  "cve": [
    "CVE-2008-4250",
    "CVE-2010-2568"
  ],
  "d3fend": [
    "D3-NTA",
    "D3-AM",
    "D3-EDR",
    "D3-URIF"
  ],
  "lineage": {
    "derived_from": [
      "Win32 IRCBot / Worm Modular Lineage"
    ],
    "variants": [
      "Worm:Win32/Kolabc.A",
      "Worm:Win32/Kolabc.B",
      "Trojan.Kolabc.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "d41d8cd98f00b204e9800998ecf8427e997f74b451e06e8979dd4a946e330a11",
      "8c91a0c7e0984fb23498a91264b91238914b109348914ba081394b819234b912"
    ],
    "delivery": [
      "Removable USB storage drive propagation",
      "Unsecured SMB network shares",
      "Drive-by exploit downloads"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\KolabSvc",
      "Autorun.inf on removable storage devices"
    ]
  },
  "yara_rules": [
    "rule Worm_Win32_Kolabc { meta: description = \"Detects Kolabc network worm and botnet client\" strings: $s1 = \"autorun.inf\" $s2 = \"svchost.exe\" $s3 = \"JOIN #kolab\" $s4 = \"PRIVMSG\" condition: uint16(0) == 0x5A4D and 3 of ($s*) }"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Worm:Win32/Kolabc",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Kolabc"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Worm.Win32.Kolab",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    },
    {
      "name": "Kaspersky Virus Encyclopedia - Worm.Win32.Kolabc",
      "url": "https://securelist.com"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}