FormBook arrives mostly as a RAR attachment in spam mail containing an executable, usually a .NET (MSIL) file. It steals browser and mail credentials, takes screenshots, and can receive commands to download or update further payloads.
How the layers fit
outer EXE (MSIL)
decrypts an embedded blob -> SafeSerializationManager.dll (stage 1)
stage 1 decrypts -> UI.dll (stage 2)
stage 2 decrypts -> native Win32 payload (MASM-built)
The two intermediate DLLs have innocuous names that look like parts of the .NET framework. Each one decrypts the next from data inside itself.
The payload
The final stage is a 32-bit native file written in assembler (MASM), which is typical for the family. When it runs it copies itself into the user's roaming profile under a random name.
file : copy dropped in %APPDATA% under a random name
payload : native Win32 binary assembled with MASM
Notes for analysts
- Identify the stage by its file type rather than the name; the .NET stages are DLLs and the last one is a native executable.
- Dump each stage as it decrypts, because the next one is derived from it.