Formbook Delivered Through Multiple Scripts, (Thu, Nov 13th)

This report analyzes a multi-stage email-delivered FormBook campaign: an obfuscated VBS downloader waits, reconstructs and executes an obfuscated PowerShell loader which fetches a second PowerShell payload from Google Drive, writes payloads to user AppData/Temp, and injects FormBook (bin.exe) into msiexec.exe; included are SHA256s for the VBS and PE, a C2 endpoint (216.250.252.227:7719), VirusTotal references, and behavioral indicators observed on the infected host.