RAT
SQLRat
SQLRat campaigns typically involve a lure document that includes an image overlayed by a VB Form trigger.
SQLRat is a JavaScript rat operated by Anunak.
Background
SQLRat campaigns generally rely on a lure document containing an image with a VB Form trigger layered on top. When the victim double-clicks the embedded image, the form runs a VB setup script. That script drops files into %appdata%\Roaming\Microsoft\Templates\ and registers two scheduled tasks set to fire daily. These scripts handle deobfuscating and launching the primary JavaScript file mspromo.dot, which uses a character-insertion obfuscation trick that makes it look like it holds Chinese characters. Once deobfuscated, the main JavaScript is readily identifiable and includes various functions for dropping files and running scripts on the host. The SQLRat script itself opens a direct SQL connection to an attacker-controlled Microsoft database and executes the contents of various tables.
Source: Malpedia (Fraunhofer FKIE).