SWIFT-Lure ZIP Drops Formbook via 2 MB Sleep-Padded VBScript

A 1,926-Kilobyte Script That Wants You to Think It's a Payment Notice

A thirteen-kilobyte ZIP file named "Swift-015062026.zip" is circulating across at least 35 countries, carrying a single child file that expands to nearly two megabytes of VBScript — a deliberate size anomaly engineered to exhaust static scanners and outlast the time-boxed execution windows that automated sandboxes rely on. When a recipient opens the archive and runs the enclosed script, they are handing a Formbook infostealer a foothold on their machine, with credentials, keystrokes, screenshots, and clipboard contents all in scope. The staging infrastructure for that handoff — the domain basefile.click, resolving to 45.136.5.4 — was registered and TLS-certified on the same calendar day, six days before the payload files ever appeared in the wild, pointing to a campaign that was planned, not improvised.

CTX Team's analysis of this cluster identifies a layered tradecraft chain whose individual components are each familiar, but whose combination — lure-themed naming, script inflation, timing-based evasion, and image-path-disguised payload retrieval — represents a deliberate assembly of techniques that continues to defeat a meaningful fraction of automated defences. The campaign carries a severity rating of 100 and a confidence score of 85, reflecting the strength of the dual sandbox confirmation and the breadth of the victim-region footprint, tempered by a small evidence base (three file IOCs, one domain, two URLs) and one entirely uncharacterised file.

The Lure Architecture: Why "Swift-015062026.zip" Works

The outer container — SHA-256 792fcd3bc518a9a0ab152e6e74283066bac208a66df68545960c83814c1103a0, 13 KB, classified by multiple engines under the threat label trojan.drodzp/arch with popular names drodzp, arch, and kepavll — is a standard ZIP archive whose bundle metadata tells a precise story. It contains exactly one child file, with a .vbs extension, and that child's uncompressed size is 1,972,667 bytes. The ZIP's meaningful name is "Swift-015062026.zip"; the inner VBScript carries both "Swift-015062026.vbs" and the alternate name "Quotation.vbs."

The naming strategy is not accidental. SWIFT — the Society for Worldwide Interbank Financial Telecommunication — is the messaging backbone of international wire transfers. A filename constructed around "Swift" followed by what reads as a date-formatted reference number (015062026) mimics the format of a legitimate payment instruction or transaction confirmation. The alternate name "Quotation.vbs" broadens the social-engineering surface: the same payload, renamed, can plausibly impersonate a supplier quotation or procurement document. Finance officers, accounts-payable clerks, trade-finance teams, and procurement managers across the campaign's 13 targeted industries are the natural audience for either framing.

The delivery mechanism is inferred as spear-phishing email attachment [T1566.001] — no direct email telemetry is present, but the lure naming, the single-file ZIP structure, and the broad multi-region victim footprint (35 countries spanning Western Europe, North America, South and Southeast Asia, the Middle East, and Southern Africa) are all consistent with mass-distribution phishing rather than any other plausible delivery vector. The ZIP's first submission to VirusTotal on 2026-06-15 from a single unique source is consistent with an early catch from a targeted recipient or a researcher monitoring phishing feeds.

At 31 of 74 engines flagging the ZIP container, the outer wrapper is already slipping past roughly 46 percent of the scanned engine set. Engines still missing the ZIP include CrowdStrike, Elastic, Cylance, AhnLab-V3, ClamAV, and Malwarebytes — a combination that spans both enterprise EDR platforms and consumer-grade scanners, suggesting the evasion is not narrowly tuned against any single product tier. Community votes stand at one malicious, zero harmless, reflecting the file's recent emergence.

The VBScript Engine: Inflation, Idling, and the Sandbox Clock

The inner payload — SHA-256 f8a43903e5b50696f3bbb98f0221bfd5ba95c5a6e05ca26400b4fc151a489635, threat label trojan.ador/etecer, popular names ador, etecer, and formbook — is where the campaign's evasion engineering becomes explicit. At 1,926 KB, this is not a normal script. VBScript droppers in commodity phishing campaigns typically run to tens of kilobytes; a nearly two-megabyte script is an outlier by an order of magnitude.

The dossier tags on this file are "long-sleeps," "text," and "idle." These are not incidental metadata — they are direct indicators of the script's operational logic. The "long-sleeps" and "idle" tags confirm that the VBScript contains deliberate execution delays, pausing for extended periods before proceeding to its payload logic. This is a textbook implementation of time-based sandbox evasion [T1497.003]: most automated analysis environments impose a hard time ceiling on execution — commonly two to five minutes — and a script that simply waits beyond that window will appear benign to any sandbox that terminates before the malicious logic fires.

The size inflation compounds this. A nearly two-megabyte script file can serve multiple evasion purposes simultaneously: it may exhaust the memory or processing budget that some static-analysis engines allocate per file; it may push the script past size thresholds that certain email gateways or endpoint agents apply to script-type attachments; and it provides a large surface area within which the actual malicious logic can be buried among padding, comments, or decoy code that a human analyst would need time to parse. Whether the inflation is achieved through junk variable declarations, repeated string assignments, embedded encoded blobs, or some combination is not determinable without a deobfuscated source, but the effect is the same regardless of method.

The VBScript's detection ratio of 29 of 75 engines is marginally lower than the ZIP container's, which is consistent with the evasion working: the script, despite being the actual execution payload, is slightly harder for static engines to classify than the wrapper. Engines missing the VBScript include CrowdStrike, Elastic, Cylance, AhnLab-V3, ClamAV, DeepInstinct, and Malwarebytes — an overlap with the ZIP's missing set that suggests the evasion characteristics are coherent across both layers rather than coincidentally distributed. Community votes for the VBScript stand at two malicious, zero harmless.

When the script does execute — past the sleep delays, past the idle windows — the behavioural record is unambiguous. Both sandboxes that processed the file returned malicious verdicts: CAPE Sandbox classified it as malicious and named Formbook explicitly; Yomi Hunter returned a malicious classification. Two of two sandboxes, zero suspicious, zero clean. The sandbox consensus naming Formbook is the strongest single piece of evidence in this dataset.

The rule-match record during sandbox execution reinforces that consensus. Two IDS rules fired: "ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1" (high severity, Proofpoint Emerging Threats Open ruleset) and "ET DROP Spamhaus DROP Listed Traffic Inbound group 7" (medium severity, same source). The Spamhaus DROP rule is particularly significant — it fires on traffic to IP ranges that Spamhaus has designated as "do not route or peer" based on their association with spam, malware, and botnet infrastructure. Its triggering during sandbox execution of this VBScript is consistent with the script reaching out to pre-staged C2 infrastructure that already carries a negative reputation. Across the two Sigma rule sets, the VBScript accumulated 15 total matches: 2 critical (Joe Security Rule Set), 4 high, 8 medium, and 1 low (Sigma Integrated Rule Set, GitHub). The 2 critical Sigma hits are the most analytically significant — critical-severity Sigma rules in the Joe Security set are typically reserved for behaviours with very high confidence of malicious intent and low false-positive rate.

The Staging Domain: Registered, Certified, and Ready Six Days Early

The C2 and payload-staging infrastructure for this campaign resolves to a single node: basefile.click, registered on 2026-06-09 via Spaceship, Inc., resolving to the IP address 45.136.5.4. The domain's TLS certificate — issued by Let's Encrypt under the intermediate authority YR2, serial number 612d39cad88012a99e1441f1c7b5fce9fd1 — was provisioned on the same calendar day as the domain registration: 2026-06-09, at 09:28:24 UTC. The certificate carries a wildcard Subject Alternative Name of *.basefile.click, covering all subdomains, and has a validity window of 89 days, expiring 2026-09-07.

The six-day gap between infrastructure provisioning (2026-06-09) and payload first submission (2026-06-15) is a direct indicator of deliberate operational preparation. The operators did not register the domain and immediately launch; they stood up the infrastructure, confirmed it was operational, and then deployed the payload files. This structured tempo — provision, verify, launch — is more consistent with a planned campaign than with opportunistic spray-and-pray distribution. The 89-day certificate lifespan is also operationally telling: Let's Encrypt issues 90-day certificates by default, and the 89-day figure here reflects a certificate obtained at the very start of the domain's operational life, with no prior certificate history. The operator burned a fresh certificate for this operation and has roughly three months before rotation is required — a window that, if the campaign sustains activity, would require a certificate renewal decision in early September 2026.

The wildcard SAN is a low-cost operational choice that provides flexibility: any subdomain of basefile.click — whether used for C2 callbacks, payload staging, or future infrastructure expansion — is covered by the same certificate without requiring additional issuance. For an operator running a short-lived campaign on a single domain, the wildcard is slightly over-engineered, which may suggest either a template-based infrastructure provisioning workflow or an intent to use multiple subdomains that has not yet materialised in the observable evidence.

Four independent threat-intelligence vendors had already categorised basefile.click as malicious or malware-hosting at the time of analysis: alphaMountain.ai flagged it as "Malicious, Newly Registered"; Sophos categorised it as "spyware and malware"; Webroot listed it under "Malware Sites"; and Forcepoint ThreatSeeker classified it as "malicious web sites." Despite this four-vendor consensus, the domain's VirusTotal detection ratio sits at only 14 of 91 engines — meaning roughly 85 percent of the scanned engine set was not blocking it at the time of observation. This gap between specialist threat-intelligence categorisation and broad engine coverage is a recurring feature of freshly registered campaign infrastructure: the domain is new enough that many engines' URL reputation databases have not yet propagated the malicious classification.

The domain's nameservers — ns1.whitelabelservices.us and ns2.whitelabelservices.us — and its SPF record, which explicitly authorises IP 45.136.5.4 via the directive "v=spf1 +a +mx +ip4:45.136.5.4 ~all," are additional infrastructure anchors. The SPF record's explicit IP authorisation is unusual for a domain that, on its face, is a payload-staging node rather than a mail sender — it may indicate that the operator configured a standard DNS template that includes SPF by default, or that the domain was intended to serve a mail-delivery function in addition to payload staging. The WHOIS record shows the domain in "addPeriod" status at registration, consistent with a domain that had just been created and had not yet cleared the registrar's initial hold window. DNSSEC is unsigned.

No AS-level enrichment for 45.136.5.4 is available, and no cross-IOC linkages have been identified — the infrastructure fingerprint currently stands as a single-node cluster. The .click TLD and Spaceship, Inc. registrar combination appears only once, preventing cross-campaign clustering on registrar alone. The whitelabelservices.us nameserver pair and the 45.136.5.4 IP address are the most actionable hunting pivots available.

Formbook's Encoded Fetch: The PNG Path and What It Conceals

The URL IOC basefile.click/optimized_MSIljune.png is where the campaign's C2 and payload-retrieval logic converges. The path name — "optimized_MSIljune.png" — is constructed to read as an image file: a PNG, optimised, with a name that could plausibly belong to a web asset or a software installer graphic. This is consistent with Formbook's documented technique of fetching encoded payloads from attacker-controlled domains under image-file paths [T1071.001], where the .png extension and the image-sounding filename are intended to blend the retrieval request with legitimate web traffic and evade URL-based filtering that blocks obvious executable or script paths.

The actual content type of the resource at that URL is unconfirmed — no HTTP response code or content-type header was captured. The analyst outlier note on this IOC is explicit: "URL path name 'optimized_MSIljune.png' suggests a PNG-masqueraded MSI or encoded payload; no HTTP response code or content-type available — actual payload type unconfirmed." This is a meaningful gap. If the resource is an MSI installer, it would suggest a second execution stage beyond the VBScript dropper. If it is an encoded binary blob, it would be consistent with Formbook's standard loader behaviour of fetching and decoding the infostealer module from a remote host. If it is a genuine image file used as a decoy or a dead resource at the time of analysis, the picture changes again. The PNG-path pattern is suggestive, but the absence of response data means the inference must be held at medium confidence.

What the IDS rule record does confirm is that the VBScript made network contact during sandbox execution that triggered the "ET DROP Spamhaus DROP Listed Traffic Inbound group 7" rule — meaning the sandbox observed traffic to or from an IP range on Spamhaus's DROP list. Combined with the domain's threat-intelligence categorisation as C2 infrastructure (threat metadata category "c2-servers," severity 100) and the Formbook sandbox verdict, the network behaviour during execution is consistent with a live C2 callback and payload fetch, even if the specific content of the fetched resource cannot be confirmed from the current evidence.

The "ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1" IDS rule hit is worth noting separately. This rule, from the Proofpoint Emerging Threats Open ruleset, fires on base64-encoded content patterns associated with exploit kit landing pages — a signature that predates this campaign by over a decade but continues to match because the underlying encoding pattern it targets (base64-encoded content in HTTP responses, formatted in a specific way) is reused across multiple malware families and delivery mechanisms. Its firing during the VBScript's sandbox execution suggests that the script's network traffic includes base64-encoded content in a format that matches this legacy pattern — consistent with Formbook's known use of base64 encoding in its payload retrieval and C2 communication.

The third file — SHA-256 d682de69e9528cc0258b255b0a0e5ad1a355185d92bee56abd8cecb0dd352a93 — cannot be characterised, placed in the attack chain, or linked to any other IOC. Its analytical contribution is zero until additional metadata becomes available.

Victim Footprint: Thirteen Industries, Thirty-Five Countries, One Lure

The campaign's declared victim footprint — 35 countries and 13 industry verticals — is broad enough to suggest opportunistic mass distribution rather than narrow vertical targeting, but the SWIFT-themed lure imposes a de facto filter on who is likely to act on it. SWIFT messaging is the domain of banks, financial institutions, corporate treasury functions, trade-finance desks, and the procurement and accounts-payable teams that process international payments. A recipient who does not work in or adjacent to international financial transactions is unlikely to find "Swift-015062026.zip" compelling. The alternate name "Quotation.vbs" widens the aperture slightly — procurement and supply-chain personnel across manufacturing, wholesale, and construction are natural targets for a document framed as a supplier quotation — but the core social-engineering premise remains financial.

The 13 industries targeted — financial services, manufacturing, wholesale, telecommunications, technology, healthcare, aerospace, construction, consulting, education and research, retail, transportation, and support services — span the full range of organisations that process international payments or receive supplier quotations. This is not a vertically targeted campaign in the sense of, say, a campaign that exclusively targets defence contractors or healthcare providers; it is a campaign whose lure is calibrated to a transaction type that occurs across virtually every industry, making the broad vertical footprint a natural consequence of the delivery strategy rather than evidence of a sophisticated targeting decision.

Geographically, the 35 countries targeted include Austria, Belgium, Canada, Switzerland, Germany, Denmark, France, the United Kingdom, Greece, Hungary, Ireland, Israel, India, Italy, the Netherlands, Poland, Romania, Thailand, Turkey, the United States, South Africa, and Zimbabwe, among others. This distribution spans Western Europe heavily, with significant representation across South and Southeast Asia, the Middle East, and Southern Africa. The geographic spread is consistent with a campaign distributed via phishing infrastructure that does not filter by recipient geography — the operator is casting wide and relying on the lure's financial framing to self-select relevant victims.

No named threat actor or group is attributed to this campaign. The SWIFT-themed lure and the deployment of Formbook — a commodity infostealer-as-a-service family whose primary value is credential harvesting — are consistent with financially motivated threat activity, but that inference rests on the nature of the tooling and the lure rather than on any actor-specific intelligence. Formbook has been observed in campaigns attributed to a wide range of financially motivated actors across multiple regions; its commodity availability means that its presence here does not narrow the attribution space in any meaningful way. Current evidence on actor identity is thin, and the honest analytical position is that attribution remains open.

What a Two-Megabyte Script Signals About Commodity Evasion Maturity

The most analytically significant aspect of this campaign is not the payload — Formbook is well-documented, widely available, and has been in active distribution for years — but the evasion architecture wrapped around it. A VBScript dropper that is nearly two megabytes in size and explicitly tagged with long-sleep and idle timing delays represents a deliberate investment in defeating the two primary automated analysis layers that most organisations rely on: static signature scanning and dynamic sandbox execution.

The static layer is challenged by the script's size and, presumably, by obfuscation within the script body that prevents straightforward pattern matching. The roughly 40 percent miss rate across VirusTotal engines for both the ZIP container (31 of 74) and the VBScript (29 of 75) confirms that this evasion is working against a meaningful fraction of deployed defences. The engines missing the VBScript include platforms that are widely deployed in enterprise environments — the absence of detections from CrowdStrike, Elastic, and DeepInstinct among the missing set is notable, though it should be read as a point-in-time observation rather than a permanent characterisation of those platforms' capabilities.

The dynamic layer is challenged by the timing delays. Sandbox environments that impose a two-to-five-minute execution ceiling will terminate the VBScript before its payload logic fires if the sleep delays are calibrated to exceed that window. The fact that CAPE Sandbox and Yomi Hunter both returned malicious verdicts naming Formbook suggests that at least some sandbox configurations ran the script long enough to observe the malicious behaviour — but the "long-sleeps" tag indicates that other sandbox configurations, with shorter time limits, would have seen only the idle waiting behaviour and returned a clean or inconclusive verdict.

The six-day infrastructure pre-staging window adds a third layer to this picture. The operator provisioned basefile.click, confirmed its TLS certificate, and verified its operational status before deploying the payload files. This is not the behaviour of an actor who registered a domain and immediately began sending phishing emails; it is the behaviour of an actor who runs a structured operational workflow with a preparation phase distinct from the deployment phase. Combined with the wildcard TLS certificate — which covers all subdomains and provides operational flexibility beyond what a single-path payload-staging operation would require — the infrastructure choices suggest an operator who is comfortable with rapid, low-cost domain provisioning and has a repeatable process for standing up campaign infrastructure.

The .click TLD and Spaceship, Inc. registrar combination, the whitelabelservices.us nameserver pair, and the 45.136.5.4 IP address are the three most actionable infrastructure pivots available. No AS-level enrichment for the IP is available, which limits the ability to cluster this campaign against broader hosting infrastructure patterns. The absence of any cross-IOC linkage — no shared imphash, no shared code-signing certificate, no shared nameserver or registrar across multiple domains — means that this campaign currently stands as a single-node cluster: one domain, one IP, two payload files, one staging URL.

The uncharacterised third file (d682de6…) and the unresolved content type of the PNG-path URL represent the two most significant open analytical threads. If the resource at basefile.click/optimized_MSIljune.png is a second-stage implant — an MSI installer or a shellcode blob — then the campaign's impact scope extends beyond Formbook's standard infostealer capability set, and the attack chain has an additional stage that is not yet visible. If the third file is a second-stage payload or a persistence mechanism, its characterisation would materially change the campaign's assessed capability level. Both threads are worth pursuing if additional telemetry becomes available.

What this campaign ultimately illustrates is the continued operational viability of commodity infostealer delivery through a technique combination that is, individually, well understood by the security community but remains collectively effective. VBScript droppers are not new. SWIFT-themed lures are not new. Formbook is not new. Timing-based sandbox evasion is not new. But the assembly of these components into a coherent delivery chain — with pre-staged infrastructure, a wildcard TLS certificate, a size-inflated script, and a PNG-disguised payload path — continues to produce a campaign that defeats roughly 40 percent of scanned engines and reaches recipients across 35 countries and 13 industries. The operators' decision to invest in evasion engineering rather than novel tooling points toward a threat actor who has correctly assessed that the marginal return on evasion improvements exceeds the marginal return on payload novelty — a calculation that, given the detection rates observed here, appears to be correct.