Formbook Phishing Campaign with old Payloads

Seqrite Lab analyzed a spear-phishing campaign delivering FormBook infostealer via a multi-stage loader: a .NET dropper (PurchaseOrder.exe) unpacks and decrypts Arthur.dll, which extracts and loads Montero.dll from steganographic image data; Montero.dll decrypts a MASM-compiled final payload and deploys it via in-memory execution or process hollowing. The report details sandbox-evasion and persistence behaviors (mutex, sleep delays, scheduled tasks, exclusion creation), provides IOCs (hashes, YARA rule) and maps observed behavior to MITRE ATT&CK techniques.