A newly analyzed Windows backdoor known as TASK#STOMP has emerged, transforming built-in tools into a robust spying operation. This malware leverages PowerShell to collect sensitive information, exploiting ordinary utilities for malicious purposes.
Key Features of TASK#STOMP
TASK#STOMP initiates its attack through a Visual Basic Script (VBS) installer, which uses hidden PowerShell scripts and scheduled tasks to gather business documents, Wi-Fi credentials, clipboard data, and screenshots. The infection begins with a randomly named VBS file in a location accessible to the user. However, the exact delivery method remains unconfirmed, with potential vectors including phishing, browser downloads, or other means.
Once deployed, the backdoor establishes several persistence mechanisms to survive system reboots or partial cleanups. According to a report from Securonix shared with Cyber Security News, TASK#STOMP is a fully functional PowerShell backdoor designed for ongoing data collection and remote control.
Operational Details and Risks
The primary module of TASK#STOMP scans fixed drives for documents such as Word, PDF, PowerPoint, Excel, and archives, particularly targeting files created or modified within the past year. It uploads selected files to command servers while avoiding those larger than 500 MB. This malware also monitors drives for any changes, capturing new or altered files.
Additionally, TASK#STOMP executes Windows netsh commands to list and expose stored wireless profiles and passwords in plain text. Clipboard contents are extracted, transmitted, and cleared, and screenshots can be taken on demand. These features render TASK#STOMP a comprehensive data-gathering tool, similar to other credential-harvesting campaigns.
Persistence and Mitigation Strategies
To ensure persistence, TASK#STOMP sets up four scheduled tasks using XML files in a user-writable AppData folder, adding a script named msdiag.vbs to the Startup folder. These tasks are named to resemble legitimate Windows services, complicating detection.
Security teams are advised to scrutinize VBS or Windows Script Host processes that create tasks from AppData, especially when followed by concealed PowerShell and compiler activities. Logging PowerShell Script Blocks, AMSI records, Task Scheduler logs, and endpoint file events can be crucial for reconstructing the infection chain.
Conclusion and Recommendations
The sophistication of TASK#STOMP underscores the importance of behavioral detection in cybersecurity. To mitigate threats, organizations should preserve task XML and staged files, terminate active VBS and PowerShell processes, remove all scheduled tasks and Startup entries, and block known malicious infrastructure. Ensuring thorough system checks and reboots is essential to prevent re-infection.
Indicators of compromise and detailed analysis are vital for understanding and countering such advanced threats, reinforcing the need for proactive cybersecurity measures.
