TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
TASK#STOMP Windows backdoor combines VBScript, PowerShell, scheduled tasks, and runtime C# compilation for resilient document theft and remote command execution.
Securonix documented TASK#STOMP, a Windows backdoor whose VBScript installer stages under %LOCALAPPDATA%\WinDefendSvc, registers four scheduled tasks, and drops a Startup-folder script that can restore removed components on sign-in. Two hidden PowerShell modules search fixed drives for business documents (Office files, PDFs, archives under 500 MB), capture screenshots, extract Wi-Fi passwords via netsh, harvest clipboard data, and execute arbitrary PowerShell via Invoke-Expression. Stolen data goes to dual token-authenticated C2 servers (corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz), and an Add-Type-compiled C# helper disables TLS certificate validation. The initial access vector is unconfirmed.
- Four scheduled tasks plus Startup-folder VBS give self-restoring persistence
- Steals Office/PDF documents, screenshots, clipboard data, and Wi-Fi passwords
- Dual token-authenticated C2 failover: corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz
- PowerShell Add-Type compiles C# via csc.exe to disable TLS certificate validation
- Rotates visible scheduled-task names to defeat name-based detections
- ATT&CK
- T1053.005 Scheduled Task/Job: Scheduled TaskT1059.001 Command and Scripting Interpreter: PowerShellT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1113 Screen CaptureT1115 Clipboard Data
- Organizations
- SecuronixTASK#STOMP
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | attachmentsharingdrive.xyz | d command-and-control servers: corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. If one server fails, the malware switches to the other, |
| domain | corecloudfileshare.xyz | e with two token-authenticated command-and-control servers: corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. If one server fails, th |
From the original article
3 min read at gbhackers.com
A Windows-focused backdoor dubbed TASK#STOMP that uses VBScript, PowerShell, Scheduled Tasks, and runtime C# compilation to establish resilient persistence and continuously steal business documents. The implant also captures screenshots, extracts saved Wi-Fi passwords, harvests clipboard data, and executes arbitrary commands received from its operators.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.