Loading malware…
FormBook is a long-running Windows information-stealing malware family sold in underground markets as a ready-to-use crimeware offering. It is best known for harvesting credentials and other sensitive data from web browsers and FTP clients, and for using anti-analysis and code-decryption routines to hinder reverse engineering. FormBook has been widely distributed through malspam and phishing campaigns, including invoice-themed and COVID-19-themed lures, and has also been delivered through exploit chains abusing Microsoft Office Equation Editor vulnerability CVE-2017-11882 as well as through commodity loaders such as GuLoader and SmokeLoader. Campaign reporting has shown targeting across multiple sectors, including educational institutions, and broad opportunistic victimization in multiple regions.
Operationally, FormBook is associated with credential theft and data exfiltration from infected Windows systems. Reported behavior includes theft of saved credentials from browsers such as Chrome, Firefox, and Opera, as well as theft from FTP applications. Variants have also used process hollowing or related injection techniques to execute within legitimate Windows processes, and some analyses describe persistence mechanisms and extensive defense-evasion features, including debugger detection, hidden execution, anti-analysis logic, and use of randomly selected or legitimate processes to complicate detection.
FormBook later evolved into XLoader, a rebranded successor that introduced significant changes including improved command-and-control encryption and expansion beyond Windows to macOS. In Windows-focused reporting, XLoader is repeatedly described as behaviorally similar to FormBook and in some contexts as its direct continuation. Threat reporting has also linked XLoader activity to clusters such as UAC-0041. Despite the rebranding, FormBook remains the more established family name for the original Windows infostealer lineage and is commonly referenced in discussions of commodity credential-stealing malware delivered via phishing and exploit-based infection chains.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro uncovered a malicious Rich Text Format (RTF) file exploiting CVE-2017-11882 to deliver the spyware Loki (TSPY_LOKI). ... CVE-2017-11882 is a 17-year old memory corruption issue in Microsoft Office ... The flaw resides within Equation Editor (EQNEDT32.EXE) ... A proof-of-concept exploit was released publicly, but this has been fixed by Microsoft’s November Patch Tuesday. | Trend Micro’s initial and ongoing analysis also found that a spammer group is also actively exploiting CVE-2017-11882 to infect systems with information stealers Pony/FAREIT and FormBook.
Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444. ... The exploited vulnerability is CVE-2021-40444. | Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. ... newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
It was also observed in 2018, distributed via emails with DOCX files that contained a URL. This URL downloaded an RTF file that exploits CVE-2017-8570 and drops an executable. This executable downloads the Formbook sample. | Formbook is an infostealer that has been advertised for sale in public hacking forums since February 2016... It is more advanced than a keylogger as it can retrieve authorization and login credentials from a web data form before the information reaches a secure server, bypassing HTTPS encryption.
Until recently, FormBook mostly exploited CVE-2017-0199, but newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444. | Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. ... newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
The analytic detects a Microsoft Office product spawning the Windows msdt.exe process... Annotations ... CVE CVE-2022-30190 ... Associated Analytic Story ... Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 ... https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability | References https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
BITTER has exploited Microsoft Office vulnerabilities... CVE-2018-0798...
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These campaigns, detailed in our previous report, distributed payloads that included AgentTesla, Formbook, Lokibot, Netwire and Betabot.
...the delivered payload is in favor of publicly sold malware such as NanoCore, Formbook, etc...
XLoader and FakeSpy are two of the most prevalent malware families that emerged from the mobile threat landscape recently. We first reported about XLoader in April 2018 when it used Domain Name System (DNS) cache poisoning/DNS spoofing to victimize users with malicious Android apps that steal PII and financial data and install additional apps.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
今回のブログでは、最近観測された多段の感染プロセスを有する日本語のばらまき型攻撃メールの解析内容について解説します。メールの内容は、ばらまき型の攻撃メールでよく使用される『支払い』に関するものでした。
The Cobalt hacking group also weaponized this security flaw in one of their campaigns in late November, sending out a similarly constructed RTF file. In their previous spear-phishing campaigns, the DLL is a component of the penetration testing tool Cobalt Strike.
Finally, the DNS changer generates a URL query with the rogue DNS IPs to compromise the DNS settings of the Wi-Fi router, depending on the model
The code was hosted (and is no longer available) at this location executed a PowerShell script which in turn would download and executes a file from: hxxps://zilk[.]pw/url/smstrace.exe.
Furthermore, an ELF file, libarmeaib-v7alibdf.so, was embedded in the APK file: it uses Java Native Interface (JNI) for the second stage payload, for decryption and also part of the loading feature.
Criminals began exploiting the Microsoft MSHTML Remote Code Execution Vulnerability at least a week before September’s Patch Tuesday... If a user decompresses this malicious RAR attachment and then opens the Word document, the exploit triggers. | The JavaScript on the page would be executed within Office on an unpatched system.
Of particular interest was the presence of CreateProcessW, VirtualAlloc and ReadProcessMemory, as well as GetThreadContext and SetThreadContext. These APIs are commonly associated with process injection... | Based on the presence of VirtualProtect and DllCallAddress, we made the safe assumption that it was executable code, likely in the form of shellcode.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
さらにこの PowerShell スクリプトは、変数 codigo に格納された難読化された文字列に対して、文字列 DgTre を文字 A に置換する処理を行った後、Base64 デコードして PowerShell スクリプトを実行します。
By taking a look at the binary level, we see that XLoader Windows resolves API functions at runtime which is similar to FormBook
XLoader is now masquerading as an office productivity app called ‘OfficeNote’.
Of particular interest was the presence of CreateProcessW, VirtualAlloc and ReadProcessMemory, as well as GetThreadContext and SetThreadContext. These APIs are commonly associated with process injection... | Based on the presence of VirtualProtect and DllCallAddress, we made the safe assumption that it was executable code, likely in the form of shellcode.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
Then, the encrypted payload is XORed using the embedded XOR key. After the XOR operation, as with previous samples, the data is decompressed using zlib to extract the payload, a Dalvik Executable (DEX) file.
Written natively in the C and Objective C programming languages and signed with an Apple developer signature, XLoader is now masquerading as an office productivity app called ‘OfficeNote’.
One way is to host a file on a server controlled by the attack and use the 44 bytes for a command that accesses that server and executes another binary. For example, the following command uses the mshta executable to run VBscript code from a remote server...
FormBook and XLoader Windows steal credentials from browsers including Mozilla Firefox, Opera, and Chrome and target FTP applications
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
we can see that in both analyses, the sample tries to evade a debugger, achieves persistence, and access system data
XLoader uses a variety of dummy network calls to disguise the real C2. We observed 169 DNS name resolutions and 203 HTTP requests.
it is configured to receive C2 information ( 91.204.227.31 :28877) from a user profile on VKontakte.
1,190 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer and form grabber.
FormBook is malware associated with command-and-control check-ins from an infected Windows client; in this exercise it is the malware family driving the observed outbound C2 traffic.
2025-09-05: XLoader (Formbook) infection
Historically tagged on older samples using the same FedEx AWB lure, but the article explicitly says those historical tags do not prove the 2026 ISO delivers the same payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.