Formbook is a data stealer, but not a full-fledged banker (banking malware) It does not currently have any extensions or plug-ins. It has various behaviors like, persistence, Process Injection, Packer, Function Hooks, Startup, Beaconing. If you see JS or.EXE or.COM or.COM or.PIF or.SCR or.HTA.vbs,.wsf,.jse.jar at the end of the file name DO NOT click on it or try to open it, it will infect you.”]
Source: https://gbhackers.com/formbook-malware-weaponized-rtf/