Turla, also known as Snake / Uroburos / Venomous Bear and KRYPTON is a Russian-speaking APT group that has been active since at least 2007. Its activity can be traced to many high-profile incidents, including the 2008 attack against the US Central Command, more recently, the attack against RUAG, a Swiss military contractor. The Turla group has been known as an agile, very dynamic and innovative APT, leveraging many different families of malware, satellite-based command and control servers and malware for non-Windows OSes.
The document above shows an official letter from the Qatar Embassy in Cyprus to the Ministry of Foreign Affairs (MoFA) in Cyprus. Based on the name of the document (National Day Reception (Dina Mersine Bosio Ambassador’s Secretary).doc, it is presumed it may have been sent from the Qatar Ambassador’s secretary to the MoFA, possibly indicating Turla already had control of at least one system within Qatar’s diplomatic network.
This JS will begin by copying itself to the appropriate folder location based on the version of Windows running:
c:\Documents and Settings\
Next, it will write to the following registry key:
Value: wscript.exe /b “
After establishing its persistence, it will then execute a series of commands on the victim system using “cmd.exe /c” and store them to a file named “~dat.tmp”, in the same folder where “mailform.js” is located.
It should be noted that the above domains appear to have been compromised by the actor based on the locations of the PHP scripts.
It is advised that users disable macros in their enterprise and not allow the user to enable said content unless absolutely necessary. Also scan with Max Total Security everyday and update daily to get latest malware signatures.