# Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures

> ANY.RUN documented a Formbook (aka XLoader) campaign that delivers a ZIP-attached obfuscated JavaScript dropper, a Base64 PowerShell chain, an AES-256-CBC in-memory loader and a ConfuserEx-protected .NET injector (GHOST.dll) that hollows aspnet_compiler.exe. The final Formbook payload runs in rekeywiz.exe and steals browser-stored credentials from manufacturing, technology and finance/administration organizations in Europe and neighbouring regions.

- **Published:** 2026-11-10T12:54:29Z
- **Last reviewed:** 2026-11-10T12:54:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5645
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5645.png
- **ID:** TL-2026-5645
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

The campaign starts with an email attachment, a ZIP archive named 'Nova narudzba 0148-712.zip' (Croatian/Bosnian for 'New Order'). It contains a roughly 2 MB JavaScript file obfuscated with obfuscator.io techniques (string encryption, shuffled control flow) that holds a Base64-encoded PowerShell payload. When wscript.exe runs the script, it decodes the payload, creates a working directory in C:\Temp\ (falling back to %TEMP%) and writes ps_<random>_<timestamp>.ps1. It then sets up persistence and launches PowerShell with -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo. A WMI-based monitor terminates the PowerShell process if it runs longer than 50 seconds.

The second stage is headed 'PowerShell Modular AES Pipeline Loader'. Three Base64 resources hold the encrypted payload, the key and the IV. The loader decrypts the next stage with AES-256-CBC and runs it in memory through ScriptBlock::Create(). It then clears its resource map and forces garbage collection to reduce disk artifacts. The third stage is a .NET injector, GHOST.dll, protected with ConfuserEx. It uses process hollowing to inject into the legitimate aspnet_compiler.exe. A watchdog routine named 'Operate-Beacon' checks every 5 seconds whether the hollowed process is still alive and reloads GHOST.dll and reinjects if it is not; analysts saw 15 aspnet_compiler.exe instances in one sandbox session. The final Formbook payload runs inside rekeywiz.exe (a legitimate Windows EFS utility) and launches Firefox. It also creates a randomly named file in %TEMP% that the report links to collection of browser databases and credentials.

Persistence uses the naming pattern SystemUpdate_ps_*. This covers an HKCU Run value, an attempted HKLM Run value (which fails without admin rights) and a Startup-folder shortcut SystemUpdate_ps_*.lnk described as 'System Update Service' that launches hidden PowerShell. C2 uses plain HTTP on port 80, with one GET check-in followed by several POST requests carrying stolen data. The User-Agent impersonates an Android 4.1.1 tablet even though the traffic comes from Windows hosts. The C2 domain hlushkova.top was seen resolving to different IPs, and one IP is on shared hosting, so domain-based blocking is preferable to IP blocking.

Submissions came from the UK, Italy, the Balkans and the South Caucasus, and lures were localized to match: Croatian/Bosnian new-order notices and price lists, Turkish/Azerbaijani purchase orders, SWIFT-themed bank transfers and commercial quotation requests. The same GHOST.dll hash appeared as cloked_data.exe in a separate analysis on 2026-10-09, which indicates tooling reuse. ANY.RUN also found that the C:\Temp\ps_*.ps1 and Startup\SystemUpdate_ps_*.lnk artifact patterns recur across other commodity families (AgentTesla, DarkCloud, Remcos, XWorm, Snake Keylogger, AsyncRAT), so they indicate a shared loader pattern and are not specific to Formbook. The source does not state attribution or a Formbook/XLoader version. Severity is analyst-assigned and no CVSS applies.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1547.009 Shortcut Modification
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1564.003 Hidden Window
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1005 Data from Local System
- T1555.003 Credentials from Web Browsers
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Formbook/XLoader JS Dropper: wscript.exe Launching Hidden PowerShell ps_*.ps1 Stage** (`TL-2026-5645-SPL-001`)

Detects the first execution stage of the Formbook (XLoader) campaign TL-2026-5645: a ZIP-delivered obfuscated JavaScript file run by wscript.exe/cscript.exe that drops C:\Temp\ps_<random>_<timestamp>.ps1 and launches PowerShell with -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo. Behaviour-first: fires on a script host spawning a hidden, policy-bypassing PowerShell child or running a ps_*.ps1 stage. ANY.RUN notes the ps_*.ps1 pattern recurs across commodity loaders (AgentTesla, Remcos, XWorm, AsyncRAT), so a hit indicates this shared loader chain, not necessarily only Formbook.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1059.001, T1564.003
- **Data sources:** sysmon, splunk:XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  (ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe")
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*ps_*.ps1*" OR (CommandLine="*Bypass*" AND CommandLine="*Hidden*" AND CommandLine="*NonInteractive*"))
```tag the two dropper markers: random ps_ script name and hidden window flag```
| eval ps1_stage=if(match(CommandLine,"(?i)ps_[0-9A-Za-z_-]+[.]ps1"),"ps_random_ps1","none")
| eval hidden_window=if(match(CommandLine,"(?i)-w(indowstyle)?[ ]+hidden"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as powershell_cmdline values(ParentCommandLine) as dropper_cmdline values(ps1_stage) as ps1_stage max(hidden_window) as hidden_window by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)ps_[0-9a-z_-]+\.ps1"
    or (ProcessCommandLine has "Bypass" and ProcessCommandLine has "Hidden" and ProcessCommandLine has "NonInteractive")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Formbook XLoader JS Dropper Launching Hidden PowerShell Stage
id: 3f1c2a7e-8b4d-4e21-9a5c-6d0e7b1f2a01
status: experimental
description: 'Detects wscript.exe or cscript.exe launching PowerShell with a ps_ random ps1 script or with Bypass Hidden NonInteractive flags, as used by the Formbook XLoader JS dropper chain (TL-2026-5645).'
references:
    - https://any.run/cybersecurity-blog/formbook-malware-analysis-november-2026/
    - https://socprime.com/active-threats/inside-the-xloader-infection-chain/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.execution
    - attack.t1059.007
    - attack.t1059.001
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1564.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ps1:
        CommandLine|contains|all:
            - 'ps_'
            - '.ps1'
    selection_flags:
        CommandLine|contains|all:
            - 'Bypass'
            - 'Hidden'
            - 'NonInteractive'
    condition: selection_parent and selection_img and (selection_ps1 or selection_flags)
falsepositives:
    - Legitimate admin logon scripts using wscript to start hidden PowerShell
    - Software deployment tooling that stages ps_*.ps1 files
level: high

```

**Known false positives:**

- Legitimate admin logon scripts using wscript.exe to start hidden PowerShell
- Software deployment or packaging tools that stage ps_*.ps1 files and run them hidden

**Tuning notes:** Adjust index/sourcetype to your Sysmon ingestion. Exclude known deployment parent command lines and signed admin script paths. Because the ps_*.ps1 pattern is shared across commodity loaders, pivot on the follow-on aspnet_compiler.exe/rekeywiz.exe activity (KQL-002, SIG-002) to confirm Formbook.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Formbook/XLoader Lure: wscript.exe Running JavaScript From ZIP Extraction or Mail Cache Path (locked: unlock with TL Creds)
- Formbook/XLoader [indicator] Hollowing of aspnet_compiler.exe and Operate-Beacon Respawn (locked: unlock with TL Creds)
- Formbook/XLoader C2 Network Connections: Known Domains/IPs and HTTP From Hollowed Processes (locked: unlock with TL Creds)
- Formbook/XLoader PowerShell Modular AES Pipeline Loader (Script Block Logging) (locked: unlock with TL Creds)
- Formbook/XLoader rekeywiz.exe Abuse: Suspicious Parent or Browser Child Process (locked: unlock with TL Creds)
- Formbook/XLoader C2 DNS Resolution: hlushkova.top, stanbicfinanceug.com and Community-Observed rush360.net (locked: unlock with TL Creds)
- Formbook/XLoader Persistence: SystemUpdate_ps_* Run Key, Startup LNK and Dropped ps_*.ps1 (locked: unlock with TL Creds)
- Formbook/XLoader C2: Android 4.1.1 Tablet User-Agent in Web Proxy Traffic (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `91.234.194[.]113`
- Domain: `www[.]hlushkova[.]top`
- File hash: `58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures (ANY.RUN)](https://any.run/cybersecurity-blog/formbook-malware-analysis-november-2026/)
- [ANY.RUN sandbox analysis session d5c664c6-08bc-4b5c-afb0-ffc19ca484c2](https://app.any.run/tasks/d5c664c6-08bc-4b5c-afb0-ffc19ca484c2)
- [ANY.RUN Related Threat Context release](https://any.run/cybersecurity-blog/related-threat-context-release/)
- [SOC Prime: Inside the XLoader Infection Chain (aspnet_compiler.exe process hollowing, ConfuserEx2)](https://socprime.com/active-threats/inside-the-xloader-infection-chain/)
- [Acronis: Trojan as a Service - From Formbook to XLoader](https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader)
- [Check Point Research: Stealth is never enough - revealing Formbook successor's C&C infrastructure](https://research.checkpoint.com/2021/stealth-is-never-enough-or-revealing-formbook-successors-cc-infrastructure/)
- [MITRE ATT&CK: XLoader (S1207)](https://attack.mitre.org/software/S1207/)
- [Zscaler: Latest XLoader obfuscation methods and network protocol](https://www.zscaler.com/jp/blogs/security-research/latest-xloader-obfuscation-methods-and-network-protocol)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5645