Skip to content

Formbook

Also known as: win.xloader

FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.

Linked Threat Actors

CobaltSWEED

C2 Infrastructure

Hosting/VPS 100%

Last 7 days

May 25, 2026
C2 Hosts: 2

Further Reading