Formbook / XLoader: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Microsoft Visual C++ (MSVC x86, CRT-less /NODEFAULTLIB)",
  "runtime": "Native Win32 subsystem executing direct NTAPI syscalls",
  "binary_footprint": "Single PE32 executable, typ. 28 KB - 48 KB unpacked core payload",
  "stub_size": "34,816 bytes (unpacked core), delivered via 250 KB - 900 KB multi-stage crypters (NSIS, VB6, or .NET)",
  "packer_obfuscation": "Custom polymorphic crypter stagers, string hashing (DJB2/CRC32), encrypted imports, and self-modifying code stubs",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "Crypter stager -> Decrypts Stage 2 shellcode -> Shellcode maps clean ntdll.dll from \\KnownDlls\\ntdll.dll -> Overwrites .text section to strip EDR hooks -> Injects into 32-bit intermediate process -> Spawns target host (svchost.exe / explorer.exe) -> Installs API hooks in browser memory -> Initiates decoy HTTP beaconing loop",
  "technical_summary": "Formbook (and its successor XLoader) is an advanced C/Assembly information stealer engineered specifically for form grabbing, keystroke interception, and credential harvesting. It executes without standard C runtime libraries, directly resolving Win32 APIs via PEB traversal and export table hashing. Formbook's evasion architecture includes reading a clean ntdll.dll copy from disk to unhook user-mode monitoring agents, performing nested multi-process injection, and cloaking its real C2 traffic beneath bursts of HTTP requests sent to dozens of legitimate decoy domains."
}

{
  "type": "Web Management Panel (PHP/MySQL) & Windows Payload Builder",
  "builder_tabs": [
    "Server Settings (Decoy domain list, real C2 URL, campaign identifier)",
    "Installation Options (Persistence registry keys, dropped file paths, run triggers)",
    "Stealer Modules (Browser hook enablement, clipboard monitoring, keylogger toggles)",
    "Network & Evasion (Decoy request count, sleep intervals, process injection targets)"
  ],
  "config_fields": [
    {
      "offset": "0x0010",
      "field": "CampaignID",
      "type": "ASCII String",
      "description": "Operator campaign tag identifier"
    },
    {
      "offset": "0x0030",
      "field": "DecoyCount",
      "type": "DWORD",
      "description": "Number of decoy domains generated per cycle (typically 64 or 128)"
    },
    {
      "offset": "0x0034",
      "field": "DecoyDomains",
      "type": "Encrypted String Array",
      "description": "List of decoy domain names used to mask C2 traffic"
    },
    {
      "offset": "0x0180",
      "field": "RealC2Index",
      "type": "DWORD",
      "description": "Zero-based index of the authentic C2 server within the domain array"
    },
    {
      "offset": "0x0184",
      "field": "RC4KeySalt",
      "type": "Byte Array (16 bytes)",
      "description": "Salt parameter used for key derivation in network encryption"
    },
    {
      "offset": "0x01A0",
      "field": "SleepInterval",
      "type": "DWORD",
      "description": "Beaconing interval in seconds between exfiltration cycles"
    }
  ],
  "payload_generation_flags": [
    "Target Subsystem: Win32 GUI",
    "Unhooking Mode: Active (\\KnownDlls\\ntdll.dll replacement)",
    "Form Grabber Target Matrix: Chromium, Gecko, WebKit, WinINet",
    "Traffic Cloaking: 64 Decoy Requests per Exfiltration Burst"
  ],
  "operator_commands": [
    "cmd /c: Executes arbitrary shell commands via cmd.exe pipe",
    "download: Fetches secondary binary from operator URL and executes",
    "run: Launches executable file on target endpoint",
    "reboot: Triggers immediate Windows system reboot",
    "shutdown: Initiates machine shutdown",
    "uninstall: Unhooks API intercepts, removes persistence keys, and wipes binary footprint"
  ],
  "interface_telemetry_analysis": "The operator interface is hosted on a LAMP stack (Linux/Apache/MySQL/PHP). The administration dashboard provides real-time geographic telemetry of compromised endpoints, organized by country code, IP address, bot ID, operating system build, and harvested credential categories. Harvested web form credentials, browser autofill entries, and keystroke logs are aggregated into relational SQL tables, allowing operators to filter submissions by targeted financial, corporate, and email domains."
}

struct Formbook_/_XLoader_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Nested Process Injection: The unpacked Formbook stub maps a clean copy of ntdll.dll to unhook API intercepts -> Spawns an intermediate 32-bit Windows system binary (e.g., explorer.exe or svchost.exe) in suspended state (CREATE_SUSPENDED) -> Writes secondary shellcode via NtAllocateVirtualMemory and NtWriteVirtualMemory -> Executes intermediate thread via NtResumeThread -> Intermediate process spawns final worker process (default browser, msiexec.exe, or cmd.exe) -> Injects core stealer routine and installs inline API hooks.",
  "ntapi_functions": [
    "ntdll!NtOpenSection",
    "ntdll!NtMapViewOfSection",
    "ntdll!NtUnmapViewOfSection",
    "ntdll!NtProtectVirtualMemory",
    "ntdll!NtAllocateVirtualMemory",
    "ntdll!NtWriteVirtualMemory",
    "ntdll!NtCreateThreadEx",
    "ntdll!NtResumeThread",
    "ntdll!NtQueryInformationProcess"
  ],
  "process_hollowing_target": "explorer.exe, svchost.exe, msiexec.exe, or default web browser executable",
  "persistence_mechanics": [
    "Registry Run Key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\[RandomID]",
    "Startup Folder: %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\[RandomName].lnk",
    "Scheduled Task: schtasks.exe /create /tn \"WindowsUpdate_[RandomID]\" /tr \"[DroppedPath]\" /sc onlogon"
  ],
  "evasion_hooks": [
    "NTDLL Unhooking: Opens \\KnownDlls\\ntdll.dll via NtOpenSection, maps section, sets memory protection to PAGE_EXECUTE_READWRITE on local ntdll.dll .text section, and overwrites hooked syscall wrappers with clean opcodes",
    "Heaven's Gate: Executes far jmp 0x33:Offset to switch processor from 32-bit compatibility mode to 64-bit mode on WoW64 systems, bypassing 32-bit user-mode API monitoring hooks",
    "Inline API Hooking: Patches browser networking functions (HttpSendRequestW, PR_Write) with 5-byte JMP stubs to redirect form data to internal buffers"
  ],
  "anti_analysis": [
    "PEB!BeingDebugged and NtGlobalFlag checking to detect attached debugger instances",
    "Hardware breakpoint detection via GetThreadContext inspecting DR0-DR3 registers",
    "Blacklisted module enumeration: Checks for sbiedll.dll, dbghelp.dll, api_log.dll, dir_watch.dll",
    "RDTSC instruction delta loops measuring execution latency across basic blocks to detect hypervisor virtualization"
  ]
}

Concrete technical breakdown of functional modules implemented in the Formbook / XLoader binary:

{
  "framing": "HTTP POST requests directed to root URI or random pseudo-static paths (e.g., /index.php, /[random_path]/). Requests are distributed across 64-128 decoy domains, with only 1 authentic C2 domain receiving active data.",
  "serialization": "URL-encoded key-value pairs containing multi-round encrypted binary payloads formatted in custom Base64",
  "handshake": "Client generates registration payload containing unique Bot HWID (derived from volume serial number and CPUID) -> Encrypts payload with RC4 and custom Base64 -> Transmits HTTP POST to decoy array -> Real C2 responds with HTTP 200 containing RC4-encrypted command structure",
  "cryptography": "Layered RC4 and rolling XOR. The encryption key is dynamically derived using SHA-1 applied to the Bot HWID combined with the static configuration salt. The encrypted buffer undergoes bitwise transposition followed by encoding with a custom 64-character alphabet.",
  "packet_types": [
    {
      "header": "POST /<path>/ (type=0)",
      "payload": "Host registration packet containing HWID, OS build, computer name, and campaign ID",
      "direction": "Client -> Server"
    },
    {
      "header": "POST /<path>/ (type=1)",
      "payload": "Exfiltration packet containing intercepted web form fields, login credentials, and target URLs",
      "direction": "Client -> Server"
    },
    {
      "header": "POST /<path>/ (type=2)",
      "payload": "Exfiltration packet containing chronological keystroke logs and clipboard text entries",
      "direction": "Client -> Server"
    },
    {
      "header": "HTTP 200 OK",
      "payload": "Encrypted command packet containing task instructions (download, execute, update, sleep)",
      "direction": "Server -> Client"
    }
  ],
  "traffic_signature": "High volume of outbound HTTP POST requests to multiple distinct, seemingly unrelated top-level domains within short time intervals. POST bodies contain high-entropy base64-like alphanumeric strings with custom padding, lacking standard MIME boundary structures."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: