New TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords
Securonix documents new TASK#STOMP PowerShell backdoor stealing documents, Wi-Fi passwords, clipboard data and screenshots with layered persistence.
Securonix analyzed TASK#STOMP, a Windows backdoor delivered by a randomly named VBS installer that deploys hidden PowerShell branches using runtime C# compilation via csc.exe. It searches fixed drives for Word, PDF, PowerPoint, Excel and archive files changed within the past year (skipping files over 500 MB), uploads them to C2 servers corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz, dumps stored Wi-Fi keys with netsh, and copies clipboard content and screenshots. Persistence uses four scheduled tasks built from XML files plus a Startup-folder VBS, with file timestamps changed to January 15, 2024 and failover between two C2 channels that accept invalid TLS certificates.
- VBS installer drops dual PowerShell payloads with csc.exe runtime compilation
- Steals recent documents, Wi-Fi keys via netsh, clipboard content, screenshots
- Four scheduled tasks plus Startup-folder VBS for restart survival
- Dual C2 domains with failover; accepts invalid TLS certificates
- IoCs include corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz
- ATT&CK
- T1059.001 Command and Scripting Interpreter: PowerShellT1053.005 Scheduled Task/Job: Scheduled TaskT1113 Screen CaptureT1115 Clipboard DataT1070.006 Indicator Removal: Timestomp
- Organizations
- Securonix
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | attachmentsharingdrive.xyz | xyz Primary TASK#STOMP command-and-control server C2 domain attachmentsharingdrive[.]xyz Backup command-and-control server used for failover URL h |
| domain | corecloudfileshare.xyz | of compromise (IoCs):- Type Indicator Description C2 domain corecloudfileshare[.]xyz Primary TASK#STOMP command-and-control server C2 domain a |
| domain | www.irantenders.com | up command-and-control server used for failover URL hxxps://www[.]irantenders[.]com/tender/tot-delete-6e137de.php URL opened by Chrome duri |
| url | https://www.irantenders.com/tender/tot-delete-6e137de.php | xyz Backup command-and-control server used for failover URL hxxps://www[.]irantenders[.]com/tender/tot-delete-6e137de.php URL opened by Chrome during the observed execution chai |
From the original article
4 min read at cybersecuritynews.com
TASK#STOMP is a newly analyzed Windows backdoor that turns ordinary built-in tools into a durable spying operation. It uses a Visual Basic Script installer, hidden PowerShell, scheduled tasks, and runtime code compilation to collect business documents, saved Wi-Fi passwords, clipboard data, and screenshots from compromised machines. The observed infection begins with a randomly named VBS […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.