{
	"id": "79bfffd8-d23a-49c0-af70-fc7a36d4ea6d",
	"created_at": "2026-04-06T02:12:21.099157Z",
	"updated_at": "2026-04-10T03:21:39.951518Z",
	"deleted_at": null,
	"sha1_hash": "590e669ec009b37211ab4e06c765538d068950e1",
	"title": "New Formbook Campaign Delivered Through Phishing Emails",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 194715,
	"plain_text": "New Formbook Campaign Delivered Through Phishing Emails\r\nBy Gustavo Palazolo\r\nPublished: 2022-03-11 · Archived: 2026-04-06 01:31:24 UTC\r\nSummary\r\nSince the beginning of 2022, the unfolding geopolitical conflict between Russia and Ukraine has resulted in the\r\ndiscovery of new malware families and related cyberattacks. In January 2022, a new malware named WhisperGate\r\nwas found corrupting disks and wiping files in Ukrainian organizations. In February 2022, another destructive\r\nmalware was found in hundreds of computers in Ukraine, named HermeticWiper, along with IsaacWiper and\r\nHermeticWizard.\r\nAside from new malware families and novel attacks, previously known malware families continue to be used\r\nagainst organizations in Ukraine and throughout the world. Recently, Netskope Threat Labs came across an\r\ninteresting phishing email addressed to high-ranking government officials in Ukraine containing Formbook (a.k.a.\r\nXLoader), which is a well-known malware operating in the MaaS (Malware-as-a-Service) model. This malware\r\nprovides full control over infected machines, offering many functionalities such as stealing passwords, grabbing\r\nscreenshots, downloading, and executing additional malware, among others.\r\nThe email seems to be part of a new spam campaign, since there were multiple emails with the same subject and\r\nbody addressed to other recipients. Most of them contain an infected spreadsheet encrypted with the\r\n“VelvetSweatshop” password, which is a known Formbook behavior. The infected spreadsheet delivers the threat\r\nthrough vulnerability described under CVE-2017-11882 and CVE-2018-0798. However, the email addressed to\r\ngovernment officials in Ukraine contains a .NET executable, responsible for loading Formbook in a multi-stage\r\nchain:\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 1 of 40\n\nIn this blog post, we will analyze all the layers from the email attachment to the last Formbook payload.\r\nPhishing Email \r\nThe infection flow starts with a generic phishing email that uses a common technique, tricking the victim into\r\ndownloading the payload by pretending to be a shipping invoice.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 2 of 40\n\nPhishing email containing a malicious attachment.\r\nThe attachment is a compressed file containing the first Formbook stage.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 3 of 40\n\nEmail attachment carrying Formbook.\r\nAlso, as we mentioned previously, we found similar emails delivering malicious spreadsheets, so we believe that\r\nthis is part of a new spam campaign delivering multiple threats.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 4 of 40\n\nSimilar phishing email with a malicious attachment.\r\nAnalysis – Summary\r\nBefore executing the last file (Formbook), the malware is divided into multiple stages, which we have\r\nsummarized below.\r\n1. Stage 01 is a loader, responsible for decoding and executing the next stage;\r\n2. Stage 02 is another loader, responsible for obtaining the encrypted bytes of Stage 03 from the resources of\r\nStage 01, decrypting and executing it;\r\n3. Stage 03 is a known packer/loader named CyaX-Sharp, responsible for decrypting and executing the last\r\nstage;\r\n4. Stage 04 is the Formbook payload, which injects itself into other processes, as described later in this\r\nanalysis.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 5 of 40\n\nSummary of Formbook loading process\r\nAnalysis – Stage 01\r\nThe first stage is a .NET executable likely compiled on February 21, 2022. This file is a loader, responsible for\r\ndecoding and executing the next stage.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 6 of 40\n\nBinary details of the first stage.\r\nOnce we decompile the file, we can see that the real executable name is “VarArgMet.exe”. This stage doesn’t\r\ncontain any code obfuscation but does contain an obfuscated string and an encrypted resource which we will\r\ndiscuss later.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 7 of 40\n\nFirst stage decompiled.\r\nAlso, this file seems to be an infected version of a public .NET project named PlaylistPanda, created in 2009.\r\nLooking at the entry point, we can see the same code that is published in the PlaylistPanda public repository,\r\nwhere the MainForm function is called, followed by InitializeComponent.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 8 of 40\n\nEntry point of the first stage.\r\nIn this malicious version, the InitializeComponent function contains the main code of the first stage. Once\r\nrunning, the code reads an obfuscated and base64 encoded string stored in a variable named x121312x121312,\r\nwhich contains the next stage. Once it’s deobfuscated and decoded, the file is passed as an argument to the\r\nfunction Springfield.  \r\nFurthermore, this loader contains a lot of junk code that will never be executed, possibly to confuse analysts and\r\nslow down analysis.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 9 of 40\n\nLoader’s main code, decoding and executing the next stage.\r\nThe Springfield function then loads the second stage as a .NET assembly, which is saved in a variable named\r\nDebuggerVisualizer.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 10 of 40\n\nSecond stage being loaded as a .NET assembly.\r\nThe DebuggerVisualizer variable is then passed as an argument to the EraInfo function, which executes the\r\nsecond stage by calling the CreateInstance function with the payload and three strings as arguments:\r\n5A6F6E654964656E746974795065726D697373696F6E417474726962 (ZoneIdentityPermissionAttrib)\r\n6F513037 (oQ07)\r\nPlaylistPanda\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 11 of 40\n\nSecond stage being executed.\r\nAnalysis – Stage 02\r\nThe second stage is a .NET DLL, likely compiled on February 16, 2022. This file is another loader responsible for\r\nexecuting the third stage, which is stored in the resources of the first stage.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 12 of 40\n\nBinary details of the second stage.\r\nOnce we decompile the file, we can see that the real name is “SpaceChemSolver.dll”. This file doesn’t have any\r\nsort of code obfuscation or protection. The entry point of this stage is the RunCore function, which is called\r\nwithin SharpStructures.Main.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 13 of 40\n\nSecond stage’s name.\r\nThis code is responsible for loading and executing the third stage, which is encrypted and stored as a resource\r\nnamed ZoneIdentityPermissionAttrib in the first stage (PlaylistPanda), masqueraded as a bitmap image.\r\nThird stage execution flow.\r\nAfter loading the fake image from the first stage resources, the function ConstructionResponse is responsible for\r\ndecrypting the binary using XOR operations with the string “oQ07”.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 14 of 40\n\nFunction that decrypts the third stage.\r\nOnce decrypted, the second stage loads the third stage as a .NET assembly, like we saw previously, executing a\r\nfunction named yjO9HynvmD.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 15 of 40\n\nThird stage being loaded.\r\nAnalysis – Stage 03 (CyaX-Sharp)\r\nThe third stage is yet another .NET file, but this time it’s protected with .NET Reactor. The compilation date is\r\nalso near the other files, on February 21, 2022. This file is a known loader/packer named CyaX-Sharp, which is\r\ncommonly used to deliver malware like AgentTesla and Warzone RAT.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 16 of 40\n\nBinary details of the third stage.\r\nBefore executing the payload, this packer offers many functionalities such as Virtual Machine and Sandbox\r\ndetection. These features can be enabled or disabled through configuration, which is stored in a string within the\r\nbinary.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 17 of 40\n\nCyaX-Sharp configuration string.\r\nOnce it’s running, it starts by parsing the configuration string and then calling the functions related to the features\r\nfor which the option is enabled.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 18 of 40\n\nCyaX-Sharp main function.\r\nThe malware checks if there’s another instance running through a Mutex object named\r\n“WuhpBQuQigdPUFFvzgV”.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 19 of 40\n\nMutex created by the third stage.\r\nThen, the malware checks if the process is running with administrative privileges, and it adds the path of the\r\nexecutable to the exclusion list of Microsoft Defender.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 20 of 40\n\nSimple Windows Defender bypass.\r\nIn this specific file, the Virtual Machine and Sandbox verification are disabled. However, just to demonstrate how\r\nit works, this malware is able to detect virtualized environments by checking the presence of specific values in the\r\nWindows Registry, used by software like VirtualBox and VMware.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 21 of 40\n\nFunctionality to detect virtualized environments.\r\nFor sandbox detection, the malware searches for common file names, loaded modules, and windows titles.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 22 of 40\n\nFunctionality to detect sandboxes.\r\nCyaX-Sharp also offers a feature to download and execute additional payloads, which is also disabled in this\r\nsample.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 23 of 40\n\nFunctionality to download and execute additional payloads.\r\nIt then copies itself to AppData, as “YtGUemuxgzC.exe”.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 24 of 40\n\nMalware copying itself to AppData.\r\nThe permission of this file is then changed to avoid anyone from deleting it.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 25 of 40\n\nChanging recently copied AppData permission.\r\nTo execute this copy, a very simple persistence technique is implemented via Windows scheduled tasks.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 26 of 40\n\nMalware’s persistence.\r\nThe final stage is then loaded from a resource named “fVkXSK7E”, which contains the encrypted bytes of\r\nFormbook.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 27 of 40\n\nCyaX-Sharp loading the final stage.\r\nBefore decrypting the payload, CyaX-Sharp builds the path string of the executable that will be used to inject\r\nFormbook. In this case, the malware is configured to use “vbc.exe”.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 28 of 40\n\nFormbook is then decrypted through bitwise operations using the bytes of the string “SUASbkTWociWWQ”.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 29 of 40\n\nCyaX-Sharp decrypting Formbook.\r\nFormbook is injected into “vbc.exe” via Process Hollowing, which we have already explained in more detail in\r\nthis analysis. All the APIs are loaded dynamically via GetProcAddress and LoadLibraryA APIs.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 30 of 40\n\nAPIs related to Process Hollowing.\r\nWe can find Formbook fully decrypted by inspecting the “vbc.exe” process memory, or by dumping the bytes\r\nonce it’s decrypted in the third stage.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 31 of 40\n\nFormbook injected into “vbc.exe”\r\nAnalysis – Stage 04 (Formbook)\r\nThe last stage is Formbook, which is an infostealer sold as a service (MaaS) on hacking-related forums since\r\n2016. This malware provides many functionalities, such as:\r\n1. Grabbing keystrokes (Keylogger);\r\n2. Grabbing screenshots;\r\n3. Grabbing HTTP(s) forms from network requests;\r\n4. Stealing data from the clipboard;\r\n5. Stealing data from common software, such as browsers, email, and ftp clients;\r\n6. Shutdown/Reboot the OS;\r\n7. Download and execute additional files;\r\n8. Remotely execute commands;\r\n9. Encrypted C2 communication;\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 32 of 40\n\nThe malware is written in ASM/C, and the compilation timestamp seems to be altered, as it indicates it was\r\ncreated in 2003.\r\nBinary details of Formbook payload.\r\nThe primary entry point of Formbook is straightforward. Once running, it calls the main function which is named\r\n“InjectMaliciousPayload” in this IDA database. Most of the strings are obfuscated using the “Stack Strings”\r\ntechnique, which can be defeated with FLOSS. A list of decoded strings for this sample can be found in our\r\nGitHub repository.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 33 of 40\n\nFormbook’s primary entry point.\r\nIt then executes a sequence of functions to assess the environment and determine whether it’s going to run, by\r\nverifying the presence of blacklisted processes and usernames, for example.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 34 of 40\n\nFormbook anti-analysis mechanisms.\r\nAfter the anti-analysis mechanisms, Formbook proceeds by creating and injecting itself into a randomly chosen\r\nprocess from Windows directory. In this case, it is injected into “svchost.exe”.\r\nFormbook injecting itself into another process.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 35 of 40\n\nAlso, another instance is injected into “explorer.exe”, responsible for the C2 communication. We found 65\r\ndifferent domains in this sample, where 64 are only used as decoys.\r\nFormbook trying to connect to domains.\r\nThe real C2 of this sample is “www.biohackingz[.]one”.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 36 of 40\n\nFormbook C2 communication.\r\nThis domain was first seen on February 21, 2022 on VirusTotal.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 37 of 40\n\nAnalysis of the C2 domain.\r\nOnce the communication is established, Formbook parses the data to determine the action that needs to be taken.\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 38 of 40\n\nPart of the function that parses the C2 response.\r\nConclusions\r\nFormbook is an infostealer, available via the Malware-as-a-Service model since 2016, often used by non-experienced people as it’s sold as a service at a reasonable price. Although it’s a simple threat, it contains many\r\nlayers and techniques to slow down analysis and bypass detection engines. Regardless of the cheap price,\r\nFormbook can be quite dangerous as it provides full access to infected systems. Netskope Threat Labs will keep\r\nmonitoring this new campaign as well as others that may emerge.\r\nProtection\r\nNetskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat\r\nindicators and payloads. \r\nNetskope Threat Protection\r\nWin32.Trojan.FormBook\r\nWin32.Spyware.Noon\r\nWin32.Malware.Heuristic\r\nByteCode-MSIL.Malware.Heuristic\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 39 of 40\n\nNetskope Advanced Threat Protection provides proactive coverage against this threat.\r\nGen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis\r\nGen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox\r\nIOCs\r\nAll the IOCs related to this campaign and the Yara rules can be found in our GitHub repository.\r\nSource: https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nhttps://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails\r\nPage 40 of 40",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"MITRE"
	],
	"references": [
		"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"
	],
	"report_names": [
		"new-formbook-campaign-delivered-through-phishing-emails"
	],
	"threat_actors": [],
	"ts_created_at": 1775441541,
	"ts_updated_at": 1775791299,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/590e669ec009b37211ab4e06c765538d068950e1.pdf",
		"text": "https://archive.orkl.eu/590e669ec009b37211ab4e06c765538d068950e1.txt",
		"img": "https://archive.orkl.eu/590e669ec009b37211ab4e06c765538d068950e1.jpg"
	}
}