Weaponized ZIP Archives and Multi-Script Chains Used to Deploy Formbook Malware

The report describes a multi-stage malware campaign that begins with a malicious ZIP containing an obfuscated VBS script which reconstructs and launches heavily obfuscated PowerShell, downloads a payload from a Google Drive link, decodes and executes it, and injects a FormBook variant into msiexec.exe; the analysis provides IOCs including file names, SHA256 hashes, a C2 IP:port, and the delivery URL.