{"id":24250,"date":"2026-11-10T12:40:37","date_gmt":"2026-11-10T12:40:37","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=24250"},"modified":"2026-11-10T13:00:30","modified_gmt":"2026-11-10T13:00:30","slug":"formbook-malware-analysis-november-2026","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/","title":{"rendered":"Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">European businesses, particularly in the UK and Italy, face malware campaigns that exploit routine business correspondence. A recent <strong>Formbook (now also known as XLoader) campaign<\/strong> uses localized order and procurement lures to deliver an information stealer. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Manufacturing and technology companies are especially exposed because employees regularly handle purchase orders, supplier documents, and payment requests. A seemingly routine attachment can hide a JavaScript loader that ultimately deploys malware to steal browser-stored credentials. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a> team investigated the campaign, uncovering its infection chain, persistence methods, and links to other malware activity. These findings show how behavioral analysis and threat intelligence can help organizations strengthen their defenses. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways <\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Localized order lures target European businesses.<\/strong> Formbook campaigns use region-specific procurement, purchase order, and payment-related documents to make malicious attachments look like routine business correspondence. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The infection chain uses multiple layers of evasion.<\/strong> Obfuscated JavaScript launches PowerShell stages, which decrypt and execute payloads in memory before deploying a .NET injector. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Process hollowing helps conceal the malware.<\/strong> The injector uses aspnet_compiler.exe to run Formbook, while a watchdog monitors the process and can reinject the payload. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The malware establishes persistence and steals browser data.<\/strong> It creates scheduled startup mechanisms and targets browser databases to collect stored credentials. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>C2 traffic contains useful detection clues.<\/strong> HTTP communication, suspicious domains, and an Android User-Agent sent from a Windows host can help identify the activity. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ANY.RUN\u2019s powerful new capability,<\/strong> <a href=\"https:\/\/any.run\/cybersecurity-blog\/related-threat-context-release\/\" target=\"_blank\" rel=\"noopener\"><strong>Related Threat Context<\/strong><\/a><strong>, reveals connections beyond the initial sample.<\/strong> Correlating shared scripts, persistence artifacts, injection components, and C2 infrastructure helps uncover related malware activity and broaden the investigation. <\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Formbook Is a Risk for European Organizations <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Formbook campaign relies on a familiar social engineering approach: making malicious attachments look like documents employees would normally receive as part of their work. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"819\" height=\"1024\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-819x1024.png\" alt=\"\" class=\"wp-image-24255\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-819x1024.png 819w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-240x300.png 240w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-768x960.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-1229x1536.png 1229w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-1638x2048.png 1638w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-370x462.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-270x338.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-740x925.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook_info-scaled.png 2048w\" sizes=\"auto, (max-width: 819px) 100vw, 819px\" \/><figcaption class=\"wp-element-caption\"><em>The Formbook attack overview<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the analyzed archives, <strong>Nova narud\u017eba 0148-712.zip<\/strong>, contains a JavaScript file with a Croatian\/Bosnian title meaning &#8220;New Order\u201d. Other related samples use themes involving price lists, procurement requests, quotations, and bank transfers. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These lures reflect everyday business processes: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Manufacturing:<\/strong> Purchase orders, supplier requests, and delivery documents are part of daily workflows. Malicious attachments can reach procurement, finance, or supply chain teams and infect corporate workstations. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Technology:<\/strong> Vendor correspondence, equipment purchases, and commercial agreements provide convincing cover for malicious files. Compromised accounts could expose internal services, customer data, and technical documents accessible to the affected users. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Finance and administration:<\/strong> Payment requests and SWIFT-themed attachments can trick employees who handle transactions and financial correspondence into opening malicious files. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The analyzed activity included submissions from the UK and Italy, alongside countries in the Balkans and South Caucasus. The language and themes of the lures indicate that attackers adapt their delivery materials to different markets rather than relying on a single generic document. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For EU-based organizations operating across multiple countries, this creates an additional detection challenge: security teams cannot assume that suspicious attachments will always use the company&#8217;s primary working language. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Business Impact of a Formbook Infection <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The consequences of a successful Formbook infection can extend beyond an individual workstation: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Corporate credential theft:<\/strong> Formbook steals browser-stored credentials, potentially exposing corporate accounts. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Unauthorized access:<\/strong> Stolen credentials may let attackers access business applications and services available to the compromised user. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Commercial data exposure:<\/strong> Manufacturing companies risk exposing supplier correspondence, pricing, purchase orders, and payment communications. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Technology asset exposure:<\/strong> Compromised accounts could expose customer data, internal services, and technical documentation. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Incident response costs:<\/strong> Investigating affected systems, resetting credentials, and containing unauthorized access can increase SOC workload and recovery costs. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The combination of convincing business lures and credential-stealing capabilities makes the activity relevant to organizations that depend on continuous supplier and customer communication. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n<span class=\"highlight\">Reduce Tier 1 to Tier 2 escalations by 30%<\/span> and keep complex investigations moving.&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=formbook-malware-analysis-2026&#038;utm_term=101126&#038;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nExplore for Your SOC<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Formbook Technical Analysis: From a Business Attachment to Credential Theft <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The analyzed sample was classified as malicious activity associated with Formbook\/XLoader. XLoader is an evolution of Formbook, so both names are used when describing the malware. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"517\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-1024x517.png\" alt=\"\" class=\"wp-image-24254\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-1024x517.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-300x152.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-766x387.png 766w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-270x136.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-370x187.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-1536x776.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-2048x1034.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_02-1-740x374.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The Formbook attack chain observed in ANY.RUN\u2019s Interactive Sandbox<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can follow the full Formbook attack chain in this <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN Sandbox<\/a> analysis. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/d5c664c6-08bc-4b5c-afb0-ffc19ca484c2?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noopener\">View analysis session and gather IOCs<\/a> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The archive was submitted to <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Interactive Sandbox<\/a> multiple times starting October 7, 2026, and appeared as an email attachment on October 23. The investigation revealed a multi-stage infection chain involving obfuscated JavaScript, hidden PowerShell execution, encrypted payload delivery, and process injection. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The infection consists of four main stages. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Localized Business Lure and JavaScript Execution <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The infection starts with <strong>Nova narud\u017eba 0148-712.zip<\/strong>, which contains a JavaScript file with the same name. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"523\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-1024x523.png\" alt=\"\" class=\"wp-image-24253\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-1024x523.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-300x153.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-768x392.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-370x189.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-270x138.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-1536x784.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-585x300.png 585w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-740x378.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_03-2048x1045.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Detonating the malicious ZIP archive reveals Formbook activity<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Approximately 2 MB in size, the script is heavily obfuscated using obfuscator.io techniques. Most of its content consists of a Base64-encoded PowerShell payload, with additional string encryption and shuffled execution logic making static analysis more difficult. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once executed, the JavaScript dropper: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Decodes the embedded PowerShell payload. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Creates a working directory under <strong>C:\\Temp\\<\/strong>, falling back to <strong>%TEMP%<\/strong> if needed. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Generates a randomized filename following the pattern <strong>ps_&lt;random>_&lt;timestamp>.ps1<\/strong>. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Writes the script to disk, establishes persistence, and launches PowerShell with hidden execution parameters. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The command includes: <strong>-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo<\/strong> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These parameters hide the PowerShell window and bypass the default execution policy. The dropper also uses WMI to monitor the process and terminate it if it runs for more than 50 seconds. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For defenders, the combination of <strong>wscript.exe<\/strong>, hidden PowerShell execution, and randomly named scripts in temporary directories is worth investigating. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. AES-Protected PowerShell Payload <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The dropped script acts as an AES loader, identified by the header PowerShell Modular AES Pipeline Loader. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"603\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-1024x603.png\" alt=\"\" class=\"wp-image-24256\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-1024x603.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-300x177.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-767x452.png 767w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-370x218.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-270x159.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-1536x905.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-740x436.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_04-2048x1207.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>PowerShell execution reveals AES-based decryption and in-memory payload loading<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It stores three Base64-encoded resources: the payload, encryption key, and initialization vector. After sanitizing and decoding them, the script uses <strong>AES-256-CBC<\/strong> to decrypt the next stage and executes it in memory through PowerShell&#8217;s <strong>ScriptBlock::Create()<\/strong> functionality. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The loader then clears its resource map and invokes garbage collection, reducing the artifacts available for disk-based analysis. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the infection is not completely fileless: the original JavaScript and intermediate PowerShell script remain useful sources of forensic evidence. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. In-Memory Injection and Formbook Delivery <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The decrypted PowerShell stage contains two components: a .NET injector named <strong>GHOST.dll<\/strong> and the final Formbook payload. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Protected with ConfuserEx, the injector uses process hollowing to execute Formbook inside the legitimate Windows process <strong>aspnet_compiler.exe<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A watchdog called <strong>Operate-Beacon<\/strong> checks every five seconds whether the process is running. If it is not, the loader reloads <strong>GHOST.dll<\/strong> and attempts injection again. <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a> analysts observed 15 instances of <strong>aspnet_compiler.exe<\/strong> during the <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">sandbox<\/a> session. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Formbook subsequently moves into <strong>rekeywiz.exe<\/strong>, a legitimate Windows EFS-related utility. From there, it launches Firefox and creates a randomly named file in <strong>%TEMP%<\/strong>, consistent with the collection of browser databases before reading them. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1018\" height=\"736\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05.png\" alt=\"\" class=\"wp-image-24258\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05.png 1018w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05-300x217.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05-768x555.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05-370x268.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05-270x195.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_05-740x535.png 740w\" sizes=\"auto, (max-width: 1018px) 100vw, 1018px\" \/><figcaption class=\"wp-element-caption\"><em>Formbook infection chain revealed in the process tree<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The final payload is designed to steal browser-stored credentials and communicate with its command-and-control infrastructure. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Because the malware uses legitimate Windows processes as containers, defenders should examine parent processes, command-line arguments, execution context, and memory behavior rather than relying on process names alone. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Persistence and Command-and-Control Communication <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The loader establishes persistence through several startup mechanisms using the naming pattern <strong>SystemUpdate_ps_*<\/strong>. The investigation identified: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A Run key value under <strong>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run<\/strong>. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An attempted Run key value under <strong>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run<\/strong>. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A shortcut named <strong>SystemUpdate_ps_*.lnk<\/strong> in the Windows Startup folder. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The shortcut uses the description System Update Service and launches PowerShell with hidden parameters. The machine-wide Run key attempt may fail without administrator privileges, but the other mechanisms can still maintain persistence. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Formbook also communicates with external C2 infrastructure over HTTP port 80. Analysts identified two domains involved in the observed activity: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>www[.]hlushkova[.]top<\/strong> <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>www[.]stanbicfinanceug[.]com<\/strong> <\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"199\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-1024x199.jpeg\" alt=\"\" class=\"wp-image-24259\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-1024x199.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-300x58.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-767x149.jpeg 767w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-1536x298.jpeg 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-370x72.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-270x52.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06-740x144.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_06.jpeg 1792w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Formbook\u2019s communication with its C2 infrastructure<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">sandbox<\/a> recorded a GET request associated with a Formbook C2 check-in, along with POST requests linked to data transmission. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, the traffic used a User-Agent impersonating an Android 4.1.1 tablet despite originating from a Windows environment. This mismatch can help defenders identify suspicious outbound HTTP traffic in proxy logs. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The domain <strong>www[.]hlushkova[.]top<\/strong> also changed its resolved IP address during the observation period. Since one of its IP addresses is associated with shared hosting, domain-based detection is preferable to blocking the IP alone. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nHelp your SOC uncover <span class=\"highlight\">up to 58% more threats<\/span>,&nbsp;speed up investigations, and improve detection.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=formbook-malware-analysis-2026&#038;utm_term=101126&#038;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nStrengthen Your Defenses<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Formbook Detection Opportunities: Indicators and Behaviors to Monitor <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The investigation revealed several artifacts that security teams can use to identify this infection chain and potentially detect related malware. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-429\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"9\"\n           data-wpID=\"429\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Indicator\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        What to investigate\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Startup shortcut\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        SystemUpdate_ps_*.lnk\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Registry persistence\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        SystemUpdate_ps_* under Windows Run keys\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        PowerShell artifacts\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        C:\\Temp\\ps_*.ps1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Process execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        wscript.exe \u2192 powershell.exe \u2192 aspnet_compiler.exe\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Repeated execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Multiple launches of aspnet_compiler.exe\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Final process\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Unexpected Formbook activity inside rekeywiz.exe\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        C2 infrastructure\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        www[.]hlushkova[.]top, www[.]stanbicfinanceug[.]com\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Network behavior\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Android 4.1.1 User-Agent from Windows hosts\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-429'>\ntable#wpdtSimpleTable-429{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-429 td, table.wpdtSimpleTable429 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">The most useful detection strategy is to correlate these indicators rather than rely on a single filename or process. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a PowerShell process is not inherently malicious. However, a hidden PowerShell instance launched by <strong>wscript.exe<\/strong>, executing a randomly named script from <strong>C:\\Temp\\<\/strong>, followed by repeated launches of <strong>aspnet_compiler.exe<\/strong>, provides a much stronger reason to investigate. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same applies to persistence. A shortcut named <strong>SystemUpdate_ps_*<\/strong> masquerading as a system update service is considerably more suspicious when combined with the associated PowerShell execution pattern. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Beyond the Original Sample: Finding Related Threats with ANY.RUN <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Investigating a suspicious attachment is just the first step. Security teams also need to identify related infrastructure, loader components, and behaviors across other attacks. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Interactive Sandbox<\/a> lets SOC and MSSP analysts execute suspicious files and observe their behavior in real time, including process activity, command-line arguments, file and registry changes, and network connections, providing insights that static analysis may miss. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Related Threat Context: Turning One Clue into a Full Investigation <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A powerful new feature inside ANY.RUN&#8217;s sandbox \u2014 <a href=\"https:\/\/any.run\/cybersecurity-blog\/related-threat-context-release\/\" target=\"_blank\" rel=\"noopener\">Related Threat Context<\/a> (Related analyses) \u2014 connects with <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Lookup<\/a> and helps SOCs and MSSPs explore connected activity beyond the original sample. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a>&#8216;s global community of over <strong>700,000 security professionals<\/strong> and <strong>16,000 organizations<\/strong> contributes to a rich source of real-world threat data, helping analysts identify connections faster. <\/p>\n\n\n\n<figure class=\"wp-block-video\"><video autoplay loop muted poster=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/related_context02-1.jpeg\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/related_context02-1.mp4\" playsinline width=\"1648\" height=\"864\" style=\"aspect-ratio: 1648 \/ 864;aspect-ratio:1648 \/ 864\"><\/video><\/figure>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\"><em>Use Related analyses to identify IOC connections and strengthen your investigation<\/em> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this investigation, another malicious archive themed around business documentation used a similar JavaScript lure, providing an additional lead for examining recurring delivery techniques. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">TI Lookup<\/a> extends this investigation by searching <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">sandbox<\/a> data for specific indicators, artifacts, and behaviors. Several queries revealed how widely the observed techniques appeared in other malware activity. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1024\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-1024x1024.png\" alt=\"\" class=\"wp-image-24262\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-1024x1024.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-150x150.png 150w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-300x300.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-768x768.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-70x70.png 70w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-1536x1536.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-370x370.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-270x270.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-2048x2048.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/v2-1-2-740x740.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Uncovering the Formbook campaign with Related Threat Context (Related analyses)<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. PowerShell artifacts<\/strong> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The query <strong>filePath:&#8221;C:\\\\Temp\\\\ps_*.ps1&#8243;<\/strong> returned 78 <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">sandbox<\/a> analyses from the previous 90 days. Besides Formbook, results included AgentTesla, DarkCloud, Remcos, XWorm, and Snake. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"504\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-1024x504.png\" alt=\"\" class=\"wp-image-24263\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-1024x504.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-300x148.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-766x377.png 766w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-1536x756.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-370x182.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-270x133.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-2048x1008.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_07-1-740x364.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup results for the filePath:&#8221;C:\\\\Temp\\\\ps_*.ps1&#8243; query<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This suggests the temporary-script pattern can help investigate multiple information stealers and remote-access threats. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Persistence artifacts<\/strong> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The query <strong>filePath:&#8221;*\\\\Startup\\\\SystemUpdate_ps_*.lnk&#8221;<\/strong> identified 42 analyses over 90 days. A search for the registry value SystemUpdate_ps_* returned 24. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"525\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-1024x525.png\" alt=\"\" class=\"wp-image-24264\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-1024x525.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-300x154.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-767x393.png 767w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-1536x787.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-370x190.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-270x138.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-2048x1050.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-585x300.png 585w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_08-740x379.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup results for the<\/em> <em>filePath:&#8221;*\\\\Startup\\\\SystemUpdate_ps_*.lnk&#8221; query<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">These artifacts also appeared in activity involving AgentTesla, Remcos, XWorm, DarkCloud, AsyncRAT, and Snake Keylogger, suggesting a potentially shared loader or distribution mechanism. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Shared injection components<\/strong> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Searching for the <strong>SHA-256<\/strong> hash of <strong>GHOST.dll<\/strong> revealed that the same injector had appeared under the filename <strong>cloked_data.exe<\/strong> in a separate analysis on October 9, 2026. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This suggests the component may be reused across different builds, making it a useful lead when investigating activity beyond the original Formbook sample. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. C2 infrastructure<\/strong> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Searching for <strong>www[.]hlushkova[.]top<\/strong> returned 14 analyses dating back to August 2026.  <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"518\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-1024x518.png\" alt=\"\" class=\"wp-image-24265\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-1024x518.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-300x152.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-767x388.png 767w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-370x187.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-270x137.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-1536x777.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-2048x1036.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_09-740x374.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup results for the<\/em> <em>www[.]hlushkova[.]top query<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The second domain, <strong>www[.]stanbicfinanceug[.]com<\/strong>, appeared in 7 analyses, with substantial overlap. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"496\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-1024x496.png\" alt=\"\" class=\"wp-image-24266\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-1024x496.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-300x145.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-768x372.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-370x179.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-270x131.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-1536x744.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-2048x993.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/formbook_10-740x359.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup results for the www[.]stanbicfinanceug[.]com query<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The associated attachments used different localized business themes, including: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Croatian\/Bosnian new-order notices. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Croatian price-list documentation. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Turkish\/Azerbaijani purchase orders. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SWIFT-themed bank-transfer documents. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Commercial quotation requests. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For <a href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktoenterprise\" data-type=\"link\" data-id=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktoenterprise\" target=\"_blank\" rel=\"noreferrer noopener\">SOC<\/a> and <a href=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktomssp\" data-type=\"link\" data-id=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktomssp\" target=\"_blank\" rel=\"noreferrer noopener\">MSSP<\/a> teams, this broader context turns one suspicious attachment into a starting point for discovering related samples, infrastructure, reusable loaders, and additional indicators.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Related Threat Context reduces repetitive IOC research for Tier 1 analysts and gives Tier 2 teams richer context for deeper investigations.<\/strong> By connecting alerts with existing threat intelligence, it helps security teams accelerate triage, reduce manual work, and make better-informed response decisions. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nGive your SOC the context to cut manual research and achieve <span class=\"highlight\">up to 94% faster triage<\/span>.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=formbook-malware-analysis-2026&#038;utm_term=101126&#038;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nAccelerate Your Investigations<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Continuous Threat Monitoring with Threat Intelligence Feeds <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Sandbox<\/a> analysis and <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">TI Lookup<\/a> help analysts investigate incidents and uncover related threats. ANY.RUN <a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Feeds<\/a> extend this visibility by bringing validated IOCs and behavior-based intelligence into existing security systems. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a>\u2019s analysis found that <strong>up to 30% of unique malicious IOCs in <\/strong><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\"><strong>Interactive Sandbox<\/strong><\/a> <strong>sessions had already been identified by ANY.RUN and were available in TI Feeds.<\/strong> <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"466\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-1024x466.png\" alt=\"\" class=\"wp-image-24267\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-1024x466.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-300x136.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-767x349.png 767w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-1536x698.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-2048x931.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-370x168.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-270x123.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/05_tifeeds01-1-740x337.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>ANY.RUN TI Feeds deliver up-to-date threat intelligence for faster detection<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This means <a href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktoenterprise\" data-type=\"link\" data-id=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktoenterprise\" target=\"_blank\" rel=\"noreferrer noopener\">SOC<\/a> and <a href=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktomssp\" data-type=\"link\" data-id=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktomssp\" target=\"_blank\" rel=\"noreferrer noopener\">MSSP<\/a> teams can match known indicators against their telemetry before manually investigating suspicious files in the Sandbox. For example, an integrated security solution can flag connections to known malicious infrastructure during routine monitoring. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Key benefits include: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Earlier detection:<\/strong> Match endpoint and network activity against known malicious indicators. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Continuous monitoring:<\/strong> Integrate threat intelligence into SIEM, EDR, and other security workflows. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster triage:<\/strong> Enrich alerts and reduce manual research. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Broader coverage:<\/strong> Apply findings from malware investigations to ongoing monitoring. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The 30% finding highlights how existing intelligence can help detect threats before manual <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">sandbox<\/a> analysis is needed. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reproducing Regional Threat Activity with Residential Proxies and Presets <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some malware uses geographic checks, localized infrastructure, or environment-dependent logic, so its behavior may vary depending on the simulated victim&#8217;s location and locale. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Interactive Sandbox<\/a> supports residential proxies and locale settings, allowing analysts to reproduce regional environments. For example, when investigating threats targeting UK or Italian businesses, they can select a proxy and locale matching the target region to better observe geographically dependent behavior. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Presets make this workflow easier. Teams can save proxy and locale combinations for different regions and reuse them across investigations, avoiding repetitive setup and keeping analysis environments consistent. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Formbook investigation shows how an ordinary business attachment can trigger a multi-stage infection designed to evade detection and steal corporate credentials. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For manufacturing and technology businesses across Europe, procurement documents, supplier requests, quotations, and payment correspondence provide convincing themes for social engineering. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Effective protection requires more than identifying suspicious files. Security teams must analyze malware behavior, investigate related threats, and apply intelligence to ongoing detection. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN brings these capabilities together: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\"><strong>Interactive Sandbox<\/strong><\/a> enables real-time analysis of suspicious files and URLs, revealing execution behavior and actionable IOCs. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/any.run\/cybersecurity-blog\/related-threat-context-release\/\" target=\"_blank\" rel=\"noopener\"><strong>Related Threat Context<\/strong><\/a> <strong>and<\/strong> <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\"><strong>Threat Intelligence Lookup<\/strong><\/a> help uncover related samples, infrastructure, loaders, and attack techniques. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noopener\"><strong>Threat Intelligence Feeds<\/strong><\/a> integrate fresh indicators and behavioral intelligence into existing security systems for continuous monitoring. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Residential proxies, locale settings, and presets<\/strong> support regional malware analysis through reusable geographic configurations. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As a result, <a href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktoenterprise\" data-type=\"link\" data-id=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktoenterprise\" target=\"_blank\" rel=\"noreferrer noopener\">SOCs<\/a> and <a href=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktomssp\" data-type=\"link\" data-id=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktomssp\" target=\"_blank\" rel=\"noreferrer noopener\">MSSPs<\/a> are able to accelerate investigations, improve detection coverage, and reduce the risk of corporate account and data compromise. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a> helps SOC and MSSP teams investigate cyber threats, improve detection, and respond to incidents more efficiently. Its solutions give security professionals the tools and intelligence they need to understand attacks and make informed decisions. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The ANY.RUN solutions include <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Interactive Sandbox<\/a> for analyzing suspicious files, URLs, and phishing activity with Threat Intelligence capabilities, such as <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-2026&amp;utm_term=101126&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Lookup<\/a>, <a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Feeds<\/a>, and <a href=\"https:\/\/intelligence.any.run\/reports?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_content=ti_reports&amp;utm_term=10112026\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Reports<\/a>. These capabilities help teams connect related incidents, monitor changes in threat infrastructure, and use findings from real-world investigations to inform their security operations. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More than 16,000 organizations and 700,000 cybersecurity professionals worldwide rely on <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=formbook-malware-analysis-november-2026&amp;utm_term=101126&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a>. The company is SOC 2 Type II certified, demonstrating its commitment to protecting customer data through established security controls. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Indicators of Compromise (IOCs) <\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">File hashes (SHA-256) <\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-430\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"8\"\n           data-wpID=\"430\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        File\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        SHA-256\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Nova narud\u017eba 0148-712.zip\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Nova narud\u017eba 0148-712.js\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        AES PowerShell loader\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        b0ee22dee7a8a9710992294f73069f047d31506b50dc1150ef6013fcd6225ed1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        PowerShell injector\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        45e598a8dddd7e9cc7b7e7a2f319c0e9f3f090ad4a089e50c3c9e4d75ee9d718\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        GHOST.dll\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        2974a808e24e76c1a9fecdaaecebefe27e841204bc1aa20536c32c1f0b309f47\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Formbook payload\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        f5c9a28325ed2eab5c7d029bfed410f05ae858b6b436e3b14891f29a6ec96d73\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Persistence shortcut\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        4fd6430a61e5d42a452c3a7de94d03173b9eb02d06aa33357fe5ee9776524aec\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-430'>\ntable#wpdtSimpleTable-430{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-430 td, table.wpdtSimpleTable430 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<h3 class=\"wp-block-heading\">Network indicators <\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-431\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"8\"\n           data-wpID=\"431\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Type\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Indicator\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        www[.]hlushkova[.]top\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        www[.]stanbicfinanceug[.]com\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        URL\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a href=\"http:\/\/www[.]hlushkova[.]top\/ef5f\/\u00a0\" target=\"_blank\">http:\/\/www[.]hlushkova[.]top\/ef5f\/\u00a0<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        URL\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a href=\"http:\/\/www[.]stanbicfinanceug[.]com\/9wgi\/\u00a0\" target=\"_blank\">http:\/\/www[.]stanbicfinanceug[.]com\/9wgi\/\u00a0<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        IP\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        91.234.194.113\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        IP\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        2.58.67.83\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        IP\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        5.9.115.199 (shared hosting)\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-431'>\ntable#wpdtSimpleTable-431{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-431 td, table.wpdtSimpleTable431 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>European businesses, particularly in the UK and Italy, face malware campaigns that exploit routine business correspondence. A recent Formbook (now also known as XLoader) campaign uses localized order and procurement lures to deliver an information stealer. Manufacturing and technology companies are especially exposed because employees regularly handle purchase orders, supplier documents, and payment requests. A [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":24272,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[8],"tags":[57,10,34],"class_list":["post-24250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware-analysis","tag-anyrun","tag-cybersecurity","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Formbook (XLoader) Malware Analysis: A Threat for EU Enterprises<\/title>\n<meta name=\"description\" content=\"Explore how Formbook (XLoader) targets European businesses through localized lures, evasion techniques, and credential theft.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"headline\":\"Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures\",\"datePublished\":\"2026-11-10T12:40:37+00:00\",\"dateModified\":\"2026-11-10T13:00:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/\"},\"wordCount\":2637,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Formbook-scaled.png\",\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\"],\"articleSection\":[\"Malware Analysis\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/\",\"name\":\"Formbook (XLoader) Malware Analysis: A Threat for EU Enterprises\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Formbook-scaled.png\",\"datePublished\":\"2026-11-10T12:40:37+00:00\",\"dateModified\":\"2026-11-10T13:00:30+00:00\",\"description\":\"Explore how Formbook (XLoader) targets European businesses through localized lures, evasion techniques, and credential theft.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#primaryimage\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Formbook-scaled.png\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Formbook-scaled.png\",\"width\":2560,\"height\":1243,\"caption\":\"Formbook Malware Analysis: A Threat for EU Enterprises\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/formbook-malware-analysis-november-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware Analysis\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/category\\\/malware-analysis\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/any.run\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/www.any.run\\\/\",\"https:\\\/\\\/x.com\\\/anyrun_app\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/30692044\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/author\\\/a-bespalova\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Formbook (XLoader) Malware Analysis: A Threat for EU Enterprises","description":"Explore how Formbook (XLoader) targets European businesses through localized lures, evasion techniques, and credential theft.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures","datePublished":"2026-11-10T12:40:37+00:00","dateModified":"2026-11-10T13:00:30+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/"},"wordCount":2637,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook-scaled.png","keywords":["ANYRUN","cybersecurity","malware analysis"],"articleSection":["Malware Analysis"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/","url":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/","name":"Formbook (XLoader) Malware Analysis: A Threat for EU Enterprises","isPartOf":{"@id":"https:\/\/any.run\/"},"primaryImageOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#primaryimage"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook-scaled.png","datePublished":"2026-11-10T12:40:37+00:00","dateModified":"2026-11-10T13:00:30+00:00","description":"Explore how Formbook (XLoader) targets European businesses through localized lures, evasion techniques, and credential theft.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#primaryimage","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook-scaled.png","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/11\/Formbook-scaled.png","width":2560,"height":1243,"caption":"Formbook Malware Analysis: A Threat for EU Enterprises"},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/formbook-malware-analysis-november-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Malware Analysis","item":"https:\/\/any.run\/cybersecurity-blog\/category\/malware-analysis\/"},{"@type":"ListItem","position":3,"name":"Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/x.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/24250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=24250"}],"version-history":[{"count":7,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/24250\/revisions"}],"predecessor-version":[{"id":24277,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/24250\/revisions\/24277"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/24272"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=24250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=24250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=24250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}