Formbook Malware Campaign Uses Malicious ZIP Files and Layered Scripting Techniques

A new Formbook malware campaign has emerged, highlighted by a phishing email that delivers a ZIP archive containing a single script named Payment_confirmation_copy_30K__202512110937495663904650431.vbs. Opening the VBS file reveals obfuscated tricks, including a 9‑second delay implemented with DateAdd and Wscript[.]Sleep to evade detection, followed by the construction of a heavily obfuscated PowerShell payload.

The payload delivers a multi‑stage chain, with the script using string concatenation to conceal keywords such as PowerShell and then invoking a layered sequence via Shell[.]Application, before downloading the next stage from hxxps://drive[.]google[.]com/uc?export=download&id=1jFn0CatcuICOIjBsP_WxcI_faBI9WA9S and saving it to C:\Users\REM\AppData\Roaming\budene[.]con.

The final payload executes via process injection into msiexec.exe, with the binary at C:\Users\REM\AppData\Local\Temp\bin.exe (SHA256:12a0f592ba833fb80cc286e28a36dcdef041b7fc086a7988a02d9d55ef4c0a9d) contacting its command and control server at 216.250.252[.]227:7719. Analysts note the obfuscation, anti‑analysis delays, and multi‑stage script execution that complicate detection, and that the VBS was detected by 17 of 65 engines on VirusTotal.

According to GBHackers On Security, these tactics emphasise the need to analyse every component in the infection chain, from the initial script to final executables.