Threat reportMalwareTL-2026-5645
Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
ANY.RUN documented a Formbook (aka XLoader) campaign that delivers a ZIP-attached obfuscated JavaScript dropper, a Base64 PowerShell chain, an AES-256-CBC in-memory loader and a ConfuserEx-protected .NET injector (GHOST.dll) that hollows aspnet_compiler.exe. The final Formbook payload runs in rekeywiz.exe and steals browser-stored credentials from manufacturing, technology and finance/administration organizations in Europe and neighbouring regions.
Key facts
| Identifiers | TL-2026-5645 |
|---|---|
| Also known as | XLoader, GHOST.dll injector, cloked_data.exe |
| Severity | HIGH |
| First disclosed | |
| Affected products | Microsoft Windows (workstations and servers) |
| Malware | Formbook, MoqHao |
| Tools | ConfuserEx |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1027 Obfuscated Files or Information, T1036 Masquerading, T1047 Windows Management Instrumentation, T1055.012 Process Hollowing, T1059.001 PowerShell, T1059.007 JavaScript, T1071.001 Web Protocols, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1547.009 Shortcut Modification and 4 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | manufacturing, technology, finance, government administration |
| Target regions | Europe, united kingdom, italy, Balkans, South Caucasus |
| Detection rules | 9 (1 shown free) |
| Sources | 8 cited sources |
Detection coverage
As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5645 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Formbook/XLoader JS Dropper: wscript.exe Launching Hidden PowerShell ps_*.ps1 Stage
Detects the first execution stage of the Formbook (XLoader) campaign TL-2026-5645: a ZIP-delivered obfuscated JavaScript file run by wscript.exe/cscript.exe that drops C:\Temp\ps_<random>_<timestamp>.ps1 and launches PowerShell with -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo. Behaviour-first: fires on a script host spawning a hidden, policy-bypassing PowerShell child or running a ps_*.ps1 stage. ANY.RUN notes the ps_*.ps1 pattern recurs across commodity loaders (AgentTesla, Remcos, XWorm, AsyncRAT), so a hit indicates this shared loader chain, not necessarily only Formbook.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1204.002, T1059.007, T1059.001, T1564.003
- Data sources: sysmon, splunk:XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, windows_process_creation
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe")
(Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
(CommandLine="*ps_*.ps1*" OR (CommandLine="*Bypass*" AND CommandLine="*Hidden*" AND CommandLine="*NonInteractive*"))
```tag the two dropper markers: random ps_ script name and hidden window flag```
| eval ps1_stage=if(match(CommandLine,"(?i)ps_[0-9A-Za-z_-]+[.]ps1"),"ps_random_ps1","none")
| eval hidden_window=if(match(CommandLine,"(?i)-w(indowstyle)?[ ]+hidden"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as powershell_cmdline values(ParentCommandLine) as dropper_cmdline values(ps1_stage) as ps1_stage max(hidden_window) as hidden_window by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)ps_[0-9a-z_-]+\.ps1"
or (ProcessCommandLine has "Bypass" and ProcessCommandLine has "Hidden" and ProcessCommandLine has "NonInteractive")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, SHA256
| order by Timestamp descSigma
title: Formbook XLoader JS Dropper Launching Hidden PowerShell Stage
id: 3f1c2a7e-8b4d-4e21-9a5c-6d0e7b1f2a01
status: experimental
description: 'Detects wscript.exe or cscript.exe launching PowerShell with a ps_ random ps1 script or with Bypass Hidden NonInteractive flags, as used by the Formbook XLoader JS dropper chain (TL-2026-5645).'
references:
- https://any.run/cybersecurity-blog/formbook-malware-analysis-november-2026/
- https://socprime.com/active-threats/inside-the-xloader-infection-chain/
author: Threadlinqs Team
date: 2026-11-10
tags:
- attack.execution
- attack.t1059.007
- attack.t1059.001
- attack.t1204.002
- attack.defense-evasion
- attack.t1564.003
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\wscript.exe'
- '\cscript.exe'
selection_img:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_ps1:
CommandLine|contains|all:
- 'ps_'
- '.ps1'
selection_flags:
CommandLine|contains|all:
- 'Bypass'
- 'Hidden'
- 'NonInteractive'
condition: selection_parent and selection_img and (selection_ps1 or selection_flags)
falsepositives:
- Legitimate admin logon scripts using wscript to start hidden PowerShell
- Software deployment tooling that stages ps_*.ps1 files
level: high
Known false positives:
- Legitimate admin logon scripts using wscript.exe to start hidden PowerShell
- Software deployment or packaging tools that stage ps_*.ps1 files and run them hidden
Tuning notes: Adjust index/sourcetype to your Sysmon ingestion. Exclude known deployment parent command lines and signed admin script paths. Because the ps_*.ps1 pattern is shared across commodity loaders, pivot on the follow-on aspnet_compiler.exe/rekeywiz.exe activity (KQL-002, SIG-002) to confirm Formbook.
- Formbook/XLoader Lure: wscript.exe Running JavaScript From ZIP Extraction or Mail Cache Path · unlock with TL Creds
- Formbook/XLoader [indicator] Hollowing of aspnet_compiler.exe and Operate-Beacon Respawn · unlock with TL Creds
- Formbook/XLoader C2 Network Connections: Known Domains/IPs and HTTP From Hollowed Processes · unlock with TL Creds
- Formbook/XLoader PowerShell Modular AES Pipeline Loader (Script Block Logging) · unlock with TL Creds
- Formbook/XLoader rekeywiz.exe Abuse: Suspicious Parent or Browser Child Process · unlock with TL Creds
- Formbook/XLoader C2 DNS Resolution: hlushkova.top, stanbicfinanceug.com and Community-Observed rush360.net · unlock with TL Creds
- Formbook/XLoader Persistence: SystemUpdate_ps_* Run Key, Startup LNK and Dropped ps_*.ps1 · unlock with TL Creds
- Formbook/XLoader C2: Android 4.1.1 Tablet User-Agent in Web Proxy Traffic · unlock with TL Creds
Indicators of compromise
As of 2026-11-10, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5645.
Sample indicators (3 of 24)
- IP address:
91.234.194[.]113 - Domain:
www[.]hlushkova[.]top - File hash:
58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10
Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.
Technical analysis
The campaign starts with an email attachment, a ZIP archive named 'Nova narudzba 0148-712.zip' (Croatian/Bosnian for 'New Order'). It contains a roughly 2 MB JavaScript file obfuscated with obfuscator.io techniques (string encryption, shuffled control flow) that holds a Base64-encoded PowerShell payload. When wscript.exe runs the script, it decodes the payload, creates a working directory in C:\Temp\ (falling back to %TEMP%) and writes ps_<random>_<timestamp>.ps1. It then sets up persistence and launches PowerShell with -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo. A WMI-based monitor terminates the PowerShell process if it runs longer than 50 seconds.
The second stage is headed 'PowerShell Modular AES Pipeline Loader'. Three Base64 resources hold the encrypted payload, the key and the IV. The loader decrypts the next stage with AES-256-CBC and runs it in memory through ScriptBlock::Create(). It then clears its resource map and forces garbage collection to reduce disk artifacts. The third stage is a .NET injector, GHOST.dll, protected with ConfuserEx. It uses process hollowing to inject into the legitimate aspnet_compiler.exe. A watchdog routine named 'Operate-Beacon' checks every 5 seconds whether the hollowed process is still alive and reloads GHOST.dll and reinjects if it is not; analysts saw 15 aspnet_compiler.exe instances in one sandbox session. The final Formbook payload runs inside rekeywiz.exe (a legitimate Windows EFS utility) and launches Firefox. It also creates a randomly named file in %TEMP% that the report links to collection of browser databases and credentials.
Persistence uses the naming pattern SystemUpdate_ps_*. This covers an HKCU Run value, an attempted HKLM Run value (which fails without admin rights) and a Startup-folder shortcut SystemUpdate_ps_*.lnk described as 'System Update Service' that launches hidden PowerShell. C2 uses plain HTTP on port 80, with one GET check-in followed by several POST requests carrying stolen data. The User-Agent impersonates an Android 4.1.1 tablet even though the traffic comes from Windows hosts. The C2 domain hlushkova.top was seen resolving to different IPs, and one IP is on shared hosting, so domain-based blocking is preferable to IP blocking.
Submissions came from the UK, Italy, the Balkans and the South Caucasus, and lures were localized to match: Croatian/Bosnian new-order notices and price lists, Turkish/Azerbaijani purchase orders, SWIFT-themed bank transfers and commercial quotation requests. The same GHOST.dll hash appeared as cloked_data.exe in a separate analysis on 2026-10-09, which indicates tooling reuse. ANY.RUN also found that the C:\Temp\ps_*.ps1 and Startup\SystemUpdate_ps_*.lnk artifact patterns recur across other commodity families (AgentTesla, DarkCloud, Remcos, XWorm, Snake Keylogger, AsyncRAT), so they indicate a shared loader pattern and are not specific to Formbook. The source does not state attribution or a Formbook/XLoader version. Severity is analyst-assigned and no CVSS applies.
MITRE ATT&CK techniques by tactic:
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hidden Window; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Privilege Escalation
Command and Control
Persistence
T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Remediation
Immediate actions
- Block www.hlushkova.top and www.stanbicfinanceug.com at DNS and web proxy; prefer domain blocking over IP blocking because 5.9.115.199 is shared hosting
- Hunt for wscript.exe spawning hidden powershell.exe that runs ps_*.ps1 from C:\Temp\, followed by repeated aspnet_compiler.exe and rekeywiz.exe launches
- Search endpoints for SystemUpdate_ps_* Run values and Startup\SystemUpdate_ps_*.lnk shortcuts
- Alert on Android User-Agent strings in outbound HTTP from Windows hosts
- Reset credentials stored in browsers on any confirmed-infected host
Workarounds
- Use AppLocker/WDAC to prevent wscript.exe/cscript.exe from running scripts from user-writable paths and archive extraction folders
Longer-term hardening
- Block or open in a non-executing viewer .js/.zip email attachments, and change the default handler for .js files from wscript.exe to Notepad
- Enable PowerShell Script Block and Module logging and AMSI; enforce Constrained Language Mode where feasible
- Restrict outbound HTTP from servers and workstations to proxied, categorized destinations
- Deploy EDR with process-injection and hollowing detection for aspnet_compiler.exe and rekeywiz.exe
- Discourage storing credentials in browsers; use an enterprise password manager with MFA
Affected and fixed versions
- Microsoft — Windows (workstations and servers)
Vulnerable versions: Hosts where wscript.exe, PowerShell and .NET aspnet_compiler.exe are available and unrestricted
Timeline
- Earliest C&C domain registration in Check Point's XLoader (Formbook successor) infrastructure table, showing the lineage this campaign's payload belongs to.
- Check Point Research publishes its analysis of XLoader C&C infrastructure: 64 configured domains (mostly decoys), delayed real C&C contact and 404-style responses.
- hlushkova.top C2 domain first appears in ANY.RUN analyses (history goes back to August 2026; exact day not stated, 14 analyses in total).
- The ZIP archive 'Nova narudzba 0148-712.zip' is first submitted to the ANY.RUN sandbox.
- The locked-ioc-20 injector hash is seen under the name locked-ioc-16 in a separate ANY.RUN analysis, which indicates tooling reuse.
- The archive is observed delivered as an email attachment in a sandbox submission.
- ANY.RUN publishes its analysis of the Formbook/XLoader campaign, including the full infection chain, IOCs and hunting queries.
Sources cited
- Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures (ANY.RUN) any.run · Research · 2026-11-10
- ANY.RUN sandbox analysis session d5c664c6-08bc-4b5c-afb0-ffc19ca484c2 app.any.run · Research
- Acronis: Trojan as a Service - From Formbook to XLoader acronis.com · Research
- Check Point Research: Stealth is never enough - revealing Formbook successor's C&C infrastructure Check Point Research · Research · 2021-08-02
- MITRE ATT&CK: XLoader (S1207) MITRE · Research
- Zscaler: Latest XLoader obfuscation methods and network protocol zscaler.com · Research
- ANY.RUN Related Threat Context release any.run · Blog
- SOC Prime: Inside the XLoader Infection Chain (aspnet_compiler.exe process hollowing, ConfuserEx2) socprime.com · Blog
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.
