Formbook

Overview

Executive Summary

Infection Vector and Technical Capabilities

• API Hooking (Form Grabbing): FormBook's core capability is hooking Windows APIs (like `HttpSendRequest` or `NtWriteFile`). This allows it to intercept "forms" (like a login page on a banking site) and steal the username and password *as the user types them*, bypassing HTTPS encryption.
• Comprehensive Stealing: Beyond form grabbing, it actively steals saved passwords from browser credential stores (Chrome, Firefox, Edge), FTP clients (FileZilla), and email clients (Outlook). It also features built-in keylogging and clipboard monitoring capabilities.
• Defense Evasion: The malware often uses process injection (e.g., injecting into `explorer.exe` or `svchost.exe`) to hide its activity and communicates with its Command and Control (C2) server using custom, obfuscated HTTP requests designed to blend in with normal web traffic.

Threat Assessment

Incident Response and Remediation

• Mandatory Credential Reset: The absolute highest priority is an immediate, global password reset for all accounts associated with the compromised user, especially Active Directory, webmail, and banking portals.
• MFA Enforcement: Ensure strict Multi-Factor Authentication (MFA) is enforced across all external-facing corporate portals to neutralize the threat of the stolen credentials being reused by the attackers.
• EDR Triage and Eradication: Utilize Endpoint Detection and Response (EDR) to trace the execution chain, kill the injected processes, and remove the FormBook executable and its persistence mechanisms (typically Registry `Run` keys).

Known aliases

Threat reports may refer to this family under multiple names:

• InfoStealer.FormBook
• Trojan.FormGrabber
• Win32/FormBook

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure.

Delivery vectors

• Phishing with RAR/ZIP/ISO attachments
• Office documents using CVE-2017-11882
• GuLoader and Snake-Loader downloaders

Network indicators

• HTTP POST to compromised WordPress sites acting as C2 gates
• Domain rotation with randomized URI paths
• Beacon every 60-120 seconds

Persistence mechanisms

• Process hollowing into explorer.exe or signed Windows binaries
• Run keys with randomized names
• No on-disk artifact in some campaigns (memory-resident)

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• Suricata FormBook C2 ruleset
• EDR rule for process hollowing of explorer.exe at startup
• YARA rule FormBook_Stealer

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FORMBOOK {
    meta:
        description = "Detects Formbook (spyware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "formbook" ascii wide nocase
        $s2 = "infostealer.formbook" ascii wide nocase
        $s3 = "trojan.formgrabber" ascii wide nocase
        $s4 = "win32/formbook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Formbook Activity
id: dbdf04e70d844c5d9373f9069998bbcb
status: experimental
description: Detects generic indicators of the formbook malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*formbook*"
            - "*infostealer.formbook*"
            - "*trojan.formgrabber*"
            - "*win32/formbook*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate host and collect volatile memory
2. Rotate all browser-stored and FTP-client credentials
3. Block C2 gate URLs at perimeter and DNS
4. Audit other hosts in the org receiving the same phishing lure

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on disk-based AV scans alone — FormBook often runs in memory only
2. Do not assume container files like ISO are safe to open
3. Do not delay credential rotation

References & External Analysis

• MITRE ATT&CK: XLoader / FormBook (S1207)
• Search "formbook" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: spyware)

Explore other malware families in the same category:

• Lokibot
• Relevantknowledge

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/formbook.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.