SYMBOLCOMMON_NAMEaka. SYNONYMS
win.formbook (Back to overview)

Formbook

aka: win.xloader

Actor(s): SWEED, Cobalt

VTCollection     URLhaus        

FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.

References
2024-12-11 ⋅ Sublime ⋅ Sublime Security
Xloader deep dive: Link-based malware delivery via SharePoint impersonation
Xloader Formbook
2024-11-13 ⋅ TEHTRIS ⋅ TEHTRIS
Cracking Formbook malware: Blind deobfuscation and quick response techniques
Formbook
2024-06-15 ⋅ Medium b.magnezi ⋅ 0xMrMagnezi
Malware Analysis FormBook
Formbook
2024-04-15 ⋅ Positive Technologies ⋅ Aleksandr Badaev, Kseniya Naumova
SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world
LokiBot 404 Keylogger Agent Tesla CloudEyE Formbook Remcos XWorm
2024-02-28 ⋅ Security Intelligence ⋅ Golo Mühr, Ole Villadsen
X-Force data reveals top spam trends, campaigns and senior superlatives in 2023
404 Keylogger Agent Tesla Black Basta DarkGate Formbook IcedID Loki Password Stealer (PWS) Pikabot QakBot Remcos
2024-01-24 ⋅ Medium shaddy43 ⋅ Shayan Ahmed Khan
Layers of Deception: Analyzing the Complex Stages of XLoader 4.3 Malware Evolution
Xloader Formbook
2023-07-06 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[QuickNote] Examining Formbook Campaign via Phishing Emails
Formbook
2023-06-30 ⋅ Github (itaymigdal) ⋅ Itay Migdal
Formbook unpacking
Formbook
2023-06-05 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
30 DAYS OF FORMBOOK: DAY 1, MONDAY 2023-06-05
Formbook
2023-04-10 ⋅ Check Point ⋅ Check Point
March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files
Agent Tesla CloudEyE Emotet Formbook Nanocore RAT NjRAT QakBot Remcos Tofsee
2023-03-30 ⋅ Zscaler ⋅ Brett Stone-Gross, Javier Vicente, Nikolaos Pantazopoulos
Technical Analysis of Xloader’s Code Obfuscation in Version 4.3
Formbook
2023-03-30 ⋅ loginsoft ⋅ Saharsh Agrawal
From Innocence to Malice: The OneNote Malware Campaign Uncovered
Agent Tesla AsyncRAT DOUBLEBACK Emotet Formbook IcedID NetWire RC QakBot Quasar RAT RedLine Stealer XWorm
2023-03-16 ⋅ Trend Micro ⋅ Cedric Pernet, Jaromír Hořejší, Loseway Lu
IPFS: A New Data Frontier or a New Cybercriminal Hideout?
Agent Tesla Formbook RedLine Stealer Remcos
2023-02-28 ⋅ ANY.RUN ⋅ ANY.RUN
XLoader/FormBook: Encryption Analysis and Malware Decryption
Formbook
2023-01-30 ⋅ Checkpoint ⋅ Arie Olshtein
Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware
Agent Tesla Azorult Buer Cerber Cobalt Strike Emotet Formbook HawkEye Keylogger Loki Password Stealer (PWS) Maze NetWire RC Remcos REvil TrickBot
2023-01-24 ⋅ Trellix ⋅ Daksh Kapur, John Fokker, Robert Venal, Tomer Shloman
Cyberattacks Targeting Ukraine Increase 20-fold at End of 2022 Fueled by Russia-linked Gamaredon Activity
Andromeda Formbook Houdini Remcos
2022-12-08 ⋅ Trustwave ⋅ Diana Lopera, Phil Hay, Rodel Mendrez
Trojanized OneNote Document Leads to Formbook Malware
Formbook
2022-11-21 ⋅ Malwarebytes ⋅ Malwarebytes
2022-11-21 Threat Intel Report
404 Keylogger Agent Tesla Formbook Hive Remcos
2022-10-05 ⋅ Fortinet ⋅ Xiaopeng Zhang
Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II
Formbook RedLine Stealer
2022-09-19 ⋅ Fortinet ⋅ Xiaopeng Zhang
Excel Document Delivers Multiple Malware By Exploiting CVE-2017-11882 – Part I
Formbook RedLine Stealer
2022-08-29 ⋅ ⋅ 360 netlab ⋅ wanghao
PureCrypter Loader continues to be active and has spread to more than 10 other families
404 Keylogger Agent Tesla AsyncRAT Formbook RedLine Stealer
2022-08-04 ⋅ ConnectWise ⋅ Stu Gonzalez
Formbook and Remcos Backdoor RAT by ConnectWise CRU
Formbook Remcos
2022-07-25 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Mass distribution of desktops (Formbook, Snake Keylogger) and use of Malware RelicRace/RelicSource as a means of delivery (CERT-UA#5056)
404 Keylogger Formbook RelicRace
2022-07-12 ⋅ Cyren ⋅ Kervin Alintanahin
Example Analysis of Multi-Component Malware
Emotet Formbook
2022-07-01 ⋅ cyble ⋅ Cyble
Xloader Returns With New Infection Technique
Formbook
2022-05-19 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
.NET Stubs: Sowing the Seeds of Discord (PureCrypter)
Aberebot AbstractEmu AdoBot 404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate
2022-03-11 ⋅ Netskope ⋅ Gustavo Palazolo
New Formbook Campaign Delivered Through Phishing Emails
Formbook
2022-03-07 ⋅ ⋅ LAC WATCH ⋅ Cyber ​​Emergency Center
I CAN'T HEAR YOU NOW! INTERNAL BEHAVIOR OF INFORMATION-STEALING MALWARE AND JSOC DETECTION TRENDS
Xloader Agent Tesla Formbook Loki Password Stealer (PWS)
2022-02-28 ⋅ AhnLab ⋅ ASEC Analysis Team
Change in Distribution Method of Malware Disguised as Estimate (VBS Script)
Formbook
2022-02-11 ⋅ forensicitguy ⋅ Tony Lambert
XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets
Formbook
2022-01-21 ⋅ Zscaler ⋅ Brett Stone-Gross, Javier Vicente
Analysis of Xloader’s C2 Network Encryption
Xloader Formbook
2022-01-18 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Seth Goodwin
FORMBOOK Adopts CAB-less Approach
Formbook
2021-11-23 ⋅ HP ⋅ Patrick Schläpfer
RATDispenser: Stealthy JavaScript Loader Dispensing RATs into the Wild
AdWind Ratty STRRAT CloudEyE Formbook Houdini Panda Stealer Remcos
2021-11-16 ⋅ Yoroi ⋅ Carmelo Ragusa, Luca Mella, Luigi Martire
Office Documents: May the XLL technique change the threat Landscape in 2022?
Agent Tesla Dridex Formbook
2021-09-30 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
Threat Thursday: xLoader Infostealer
Xloader Formbook
2021-09-29 ⋅ Trend Micro ⋅ Aliakbar Zahravi, Kamlapati Choubey, Peter Girnus, William Gamazo Sanchez
FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Formbook
2021-07-21 ⋅ Quick Heal ⋅ Rumana Siddiqui
FormBook Malware Returns: New Variant Uses Steganography and In-Memory Loading of multiple stages to steal data
Formbook
2021-07-12 ⋅ Cipher Tech Solutions ⋅ Claire Zaboeva, Dan Dash, Melissa Frydrych
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-07-12 ⋅ IBM ⋅ Claire Zaboeva, Dan Dash, Melissa Frydrych
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-04-22 ⋅ Fortinet ⋅ Xiaopeng Zhang
Deep Analysis: FormBook New Variant Delivered in Phishing Campaign – Part II
Formbook
2021-04-12 ⋅ Fortinet ⋅ Xiaopeng Zhang
Deep Analysis: New FormBook Variant Delivered in Phishing Campaign – Part I
Formbook
2021-03-17 ⋅ HP ⋅ HP Bromium
Threat Insights Report Q4-2020
Agent Tesla BitRAT ComodoSec Dridex Emotet Ficker Stealer Formbook Zloader
2021-03-11 ⋅ YouTube ( Malware_Analyzing_&_RE_Tips_Tricks) ⋅ Jiří Vinopal
Formbook Reversing - Part1 [Formbook .NET loader/injector analyzing, decrypting, unpacking, patching]
Formbook
2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Command and Control Traffic Patterns
ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot
2020-11-19 ⋅ SANS ISC InfoSec Forums ⋅ Xavier Mertens
PowerShell Dropper Delivering Formbook
Formbook
2020-11-05 ⋅ tccontre Blog ⋅ tcontre
Interesting FormBook Crypter - unconventional way to store encrypted data
Formbook
2020-10-16 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
VBA Purging Malspam Campaigns
Agent Tesla Formbook
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-07-22 ⋅ S2W LAB Inc. ⋅ S2W LAB INTELLIGENCE TEAM
'FormBook Tracker' unveiled on the Dark Web
Formbook
2020-05-31 ⋅ Malwarebytes ⋅ hasherezade
Revisiting the NSIS-based crypter
Formbook
2020-05-14 ⋅ SophosLabs ⋅ Markel Picado
RATicate: an attacker’s waves of information-stealing malware
Agent Tesla BetaBot BlackRemote Formbook Loki Password Stealer (PWS) NetWire RC NjRAT Remcos
2020-04-01 ⋅ Cisco ⋅ Andrea Kaiser, Shyam Sundar Ramaswami
Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors
Azorult CloudEyE Formbook KPOT Stealer Metamorfo Nanocore RAT NetWire RC TrickBot
2020-03-24 ⋅ Avira ⋅ Avira Protection Labs
A new technique to analyze FormBook malware infections
Formbook
2020-01-19 ⋅ 360 ⋅ kate
BayWorld event, Cyber Attack Against Foreign Trade Industry
Azorult Formbook Nanocore RAT Revenge RAT
2019-12-12 ⋅ FireEye ⋅ Chi-en Shen, Oleg Bondarenko
Cyber Threat Landscape in Japan – Revealing Threat in the Shadow
Cerberus TSCookie Cobalt Strike Dtrack Emotet Formbook IcedID Icefog IRONHALO Loki Password Stealer (PWS) PandaBanker PLEAD poisonplug TrickBot BlackTech
2019-09-26 ⋅ Proofpoint ⋅ Bryan Campbell, Jeremy Hedges, Proofpoint Threat Insight Team
New WhiteShadow downloader uses Microsoft SQL to retrieve malware
WhiteShadow Agent Tesla Azorult Crimson RAT Formbook Nanocore RAT NetWire RC NjRAT Remcos
2019-07-15 ⋅ Cisco Talos ⋅ Edmund Brumaghin
SWEED: Exposing years of Agent Tesla campaigns
Agent Tesla Formbook Loki Password Stealer (PWS) SWEED
2019-06-12 ⋅ Cyberbit ⋅ Hod Gavriel
Formbook Research Hints Large Data Theft Attack Brewing
Formbook
2019-05-02 ⋅ Usual Suspect RE ⋅ Johann Aydinbas
FormBook - Hiding in plain sight
Formbook
2019-01-01 ⋅ Virus Bulletin ⋅ Gabriela Nicolao
Inside Formbook infostealer
Formbook
2018-12-05 ⋅ Botconf ⋅ Rémi Jullian
FORMBOOK In-depth malware analysis
Formbook
2018-11-01 ⋅ Peerlyst ⋅ Sudhendu
How to Analyse FormBook - A New Malware-as-a-Service
Formbook
2018-10-16 ⋅ Peerlyst ⋅ Sudhendu
How to understand FormBook - A New Malware-as-a-Service
Formbook
2018-06-22 ⋅ InQuest ⋅ Aswanda
FormBook stealer: Data theft made easy
Formbook
2018-06-20 ⋅ Cisco Talos ⋅ Paul Rascagnères, Warren Mercer
My Little FormBook
Formbook
2018-03-29 ⋅ Stormshield ⋅ Rémi Jullian
In-depth Formbook malware analysis – Obfuscation and process injection
Formbook
2018-01-29 ⋅ Vitali Kremez Blog ⋅ Vitali Kremez
Let's Learn: Dissecting FormBook Infostealer Malware: Crypter & "RunLib.dll"
Formbook
2017-10-05 ⋅ FireEye ⋅ Nart Villeneuve, Randi Eitzman, Sandor Nemes, Tyler Dean
Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea
Formbook
2017-09-20 ⋅ NetScout ⋅ Dennis Schwarz
The Formidable FormBook Form Grabber
Formbook
2016-06-01 ⋅ Safety First Blog ⋅ SL4ID3R
Form Grabber 2016 [Crome,FF,Opera,Thunderbird, Outlook IE Safari] Hack the world
Formbook
Yara Rules
[TLP:WHITE] win_formbook_auto (20241030 | Detects win.formbook.)
rule win_formbook_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.formbook."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 55 8bec 8b4508 8b480c 56 6a05 51 }
            // n = 7, score = 2200
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b480c               | mov                 ecx, dword ptr [eax + 0xc]
            //   56                   | push                esi
            //   6a05                 | push                5
            //   51                   | push                ecx

        $sequence_1 = { c3 6a01 8d8d00fcffff 6a0a 51 e8???????? }
            // n = 6, score = 2200
            //   c3                   | ret                 
            //   6a01                 | push                1
            //   8d8d00fcffff         | lea                 ecx, [ebp - 0x400]
            //   6a0a                 | push                0xa
            //   51                   | push                ecx
            //   e8????????           |                     

        $sequence_2 = { 8db4089979825a 8b4df8 8b45fc c1ca02 8bd9 8955fc 8975f8 }
            // n = 7, score = 2200
            //   8db4089979825a       | lea                 esi, [eax + ecx + 0x5a827999]
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   c1ca02               | ror                 edx, 2
            //   8bd9                 | mov                 ebx, ecx
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   8975f8               | mov                 dword ptr [ebp - 8], esi

        $sequence_3 = { 8d8d4cfdffff 51 52 56 e8???????? 83c424 85c0 }
            // n = 7, score = 2200
            //   8d8d4cfdffff         | lea                 ecx, [ebp - 0x2b4]
            //   51                   | push                ecx
            //   52                   | push                edx
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c424               | add                 esp, 0x24
            //   85c0                 | test                eax, eax

        $sequence_4 = { c785dcfeffff74005600 c785e0feffff65007200 c785e4feffff73006900 c785e8feffff6f006e00 }
            // n = 4, score = 2200
            //   c785dcfeffff74005600     | mov    dword ptr [ebp - 0x124], 0x560074
            //   c785e0feffff65007200     | mov    dword ptr [ebp - 0x120], 0x720065
            //   c785e4feffff73006900     | mov    dword ptr [ebp - 0x11c], 0x690073
            //   c785e8feffff6f006e00     | mov    dword ptr [ebp - 0x118], 0x6e006f

        $sequence_5 = { 0faf4ef8 83c6ec 83c002 0faf4608 83c014 3bc1 }
            // n = 6, score = 2200
            //   0faf4ef8             | imul                ecx, dword ptr [esi - 8]
            //   83c6ec               | add                 esi, -0x14
            //   83c002               | add                 eax, 2
            //   0faf4608             | imul                eax, dword ptr [esi + 8]
            //   83c014               | add                 eax, 0x14
            //   3bc1                 | cmp                 eax, ecx

        $sequence_6 = { 8b4510 8955d0 2b4134 83c408 8945cc 8b89a0000000 03cb }
            // n = 7, score = 2200
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8955d0               | mov                 dword ptr [ebp - 0x30], edx
            //   2b4134               | sub                 eax, dword ptr [ecx + 0x34]
            //   83c408               | add                 esp, 8
            //   8945cc               | mov                 dword ptr [ebp - 0x34], eax
            //   8b89a0000000         | mov                 ecx, dword ptr [ecx + 0xa0]
            //   03cb                 | add                 ecx, ebx

        $sequence_7 = { 33c0 81ff00000040 0f94c0 5e 5f 5b 8be5 }
            // n = 7, score = 2200
            //   33c0                 | xor                 eax, eax
            //   81ff00000040         | cmp                 edi, 0x40000000
            //   0f94c0               | sete                al
            //   5e                   | pop                 esi
            //   5f                   | pop                 edi
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp

        $sequence_8 = { 898579ffffff 89857dffffff 894581 894585 894589 6689458d 88458f }
            // n = 7, score = 2200
            //   898579ffffff         | mov                 dword ptr [ebp - 0x87], eax
            //   89857dffffff         | mov                 dword ptr [ebp - 0x83], eax
            //   894581               | mov                 dword ptr [ebp - 0x7f], eax
            //   894585               | mov                 dword ptr [ebp - 0x7b], eax
            //   894589               | mov                 dword ptr [ebp - 0x77], eax
            //   6689458d             | mov                 word ptr [ebp - 0x73], ax
            //   88458f               | mov                 byte ptr [ebp - 0x71], al

        $sequence_9 = { 8b07 83c414 0345f8 5f 5e 5b }
            // n = 6, score = 2200
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   83c414               | add                 esp, 0x14
            //   0345f8               | add                 eax, dword ptr [ebp - 8]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

    condition:
        7 of them and filesize < 371712
}
[TLP:WHITE] win_formbook_w0   (20230118 | No description)
rule win_formbook_w0 {
    meta:
        author = "@malgamy12"
        date = "2022-11-8"
	    license = "DRL 1.1"
        sample1 = "9fc57307d1cce6f6d8946a7dae41447b"
        sample2 = "0f4a7fa6e654b48c0334b8b88410eaed"
        sample3 = "0a25d588340300461738a677d0b53cd2"
        sample4 = "57d7bd215e4c4d03d73addec72936334"
        sample5 = "c943e31f7927683dc1b628f0972e801b"
        sample6 = "db87f238bb4e972ef8c0b94779798fa9"
        sample7 = "8ba1449ee35200556ecd88f23a35863a"
        sample8 = "8ca20642318337816d5db9666e004172"
        sample9 = "280f7c87c98346102980c514d2dd25c8"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook"
        malpedia_rule_date = "20230118"
        malpedia_hash = ""
        malpedia_version = "20230118"
        malpedia_license = "DRL 1.1"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $a1 = { 8B 45 ?? BA ?? [3] 8B CF D3 E2 84 14 03 74 ?? 8B 4D ?? 31 0E 8B 55 ?? 31 56 ?? 8B 4D ?? 8B 55 ?? 31 4E ?? 31 56 ?? }
			
        $a2 = { 0F B6 3A 8B C8 C1 E9 ?? 33 CF 81 E1 [4] C1 E0 ?? 33 84 8D [4] 42 4E }
        
        $a3 = { 1A D2 80 E2 ?? 80 C2 ?? EB ?? 80 FA ?? 75 ?? 8A D0 80 E2 ?? }

        $a4 = { 80 E2 ?? F6 DA 1A D2 80 E2 ?? 80 C2 ?? }

    condition:
         3 of them
}
Download all Yara Rules