ThreatLabz

Xloader (formerly Formbook) is an active information-stealing malware sold as a Malware-as-a-Service; this report analyzes the Windows variant’s C2 communication protocol and multi-layer encryption, including custom virtual machine decryption, RC4-derived keys, and character substitution/encoding used in GET/POST payloads. The analysis explains how decoy domains are embedded, how the real C2 is recovered, and documents sample-specific key-derivation behavior and IOCs (SHA256 and C2 URLs) to aid detection and response.