MALWARE FAMILY

Formbook

Internal ID: win.formbook

aliases

Last seen:Mar 17, 2026

Intelligence Profile

FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.

Threat Analysis

Formbook is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/

→http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html

→http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html

→https://0xmrmagnezi.github.io/malware%20analysis/FormBook/

→https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/

→https://asec.ahnlab.com/en/32149/

→https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/

→https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/

→https://blog.cyble.com/2022/07/01/xloader-returns-with-new-infection-technique/

→https://blog.malwarebytes.com/threat-analysis/2021/05/revisiting-the-nsis-based-crypter/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.formbook

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Formbook