A recent malware campaign demonstrates the continued use of multi‑stage infection chains to bypass security controls and deliver the FormBook information stealer.
The attack begins with a simple visual hook, an email carrying a ZIP attachment, but unfolds through a complex sequence of obfuscated scripts designed to evade detection and maintain persistence.
From VBS to PowerShell Obfuscation
The initial ZIP archive delivered a Visual Basic Script (VBS) file named Payment_confirmation_copy_30K__202512110937495663904650431.vbs (SHA256: d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f), which was flagged by 17 of 65 antivirus engines on VirusTotal.
Although simple in appearance, the script contained layered obfuscation to conceal its true purpose. The infection begins with a nine‑second delay loop, implemented through a date‑based timer instead of the more obvious Sleep() function to reduce heuristic detection.
The VBS then builds a PowerShell command by concatenating fragmented strings, even encoding the word “PowerShell” through an array of calculated ASCII values. Once reconstructed, it launches a new PowerShell process using a Shell.Application object.
The PowerShell layer is heavily obfuscated using two core functions—Microcoulomb and Blokbogstavers65.
The first selectively extracts characters from encoded strings to rebuild malicious code fragments, while the second executes them using Invoke-Expression.
For example, the variable $mesoventrally eventually resolves to the string nET.wEBClIent, indicating the use of .NET’s web functions for payload retrieval.
Download and Injection Process
The PowerShell script attempts to download the next payload from a Google Drive link:hxxps://drive[.]google[.]com/uc?export=download&id=1jFn0CatcuICOIjBsP_WxcI_faBI9WA9S
Once retrieved, the payload is stored in C:\Users\REM\AppData\Roaming\budene.con, decoded into another PowerShell script, and executed.
This stage handles the process injection, where msiexec.exe is launched and a malicious executable (C:\Users\REM\AppData\Local\Temp\bin.exe, SHA256: 12a0f592ba833fb80cc286e28a36dcdef041b7fc086a7988a02d9d55ef4c0a9d) is injected into it.
Analysis confirms this final binary as a variant of FormBook, a well‑known stealer designed to collect credentials, screenshots, and keystrokes.
The malware communicates with its command‑and‑control (C2) server at 216[.]250[.]252[.]227:7719. Throughout the sequence, every stage from VBS to PowerShell to binary employs obfuscation, encoding, and living‑off‑the‑land techniques to avoid detection.
This campaign underscores that reverse engineering should not be limited to executable binaries. Modern infections rely on multiple lightweight scripts and trusted processes that collectively deliver a powerful and stealthy payload.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
