TASK#STOMP plants five persistence footholds from a single desktop VBScript

TASK#STOMP is a Windows backdoor that searches a victim's drives for business documents, uploads them to attacker servers, and stays resident to grab each new or edited document; it also steals saved Wi-Fi passwords and clipboard text, takes screenshots, and runs whatever command its operators send.

The malware plants at least five footholds, four scheduled tasks and a copy of itself in the Startup folder, and researchers warn that removing only one may leave the others able to rebuild the infection.

The infection chain begins with wscript.exe executing an encoded VBScript file staged on the victim's desktop, 95c9050t66.vbs; the completely random file name is suspected of being intended to evade file name-based detection.

sys_loader.ps1 decodes diag_pack.dat and initiates the payload that steals system metadata, business documents, Wi-Fi passwords and clipboard content, monitors for newly modified files, takes screenshots, and executes arbitrary PowerShell commands.

win_conn.ps1 decodes win_conn_cfg.dat and sets up a secondary, persistent C2 channel with command execution and collection capabilities.

"Running the modules as separate processes provides functional separation and operational redundancy: failure or termination of one branch does not immediately remove the other," Securonix said.

Both modules communicate with the same C2 infrastructure, corecloudfileshare[.]xyz or attachmentsharingdrive[.]xyz.

The two components incorporate a mutual-watchdog relationship in which diag_pack.dat checks whether win_conn.ps1 is running and restarts it if not, and vice versa.

Securonix found the same bug in both modules that leaves part of the mutual watchdog logic largely unreachable.

Securonix does not treat the IranTenders site itself as malicious, and it warns against blocking the whole domain without more evidence.

In the final stage the VBScript orchestrator opens Google Chrome in a maximized window at a specific URL on irantenders[.]com, which hosts a searchable database of all tenders and contracts issued by government departments and local authorities in Iran; the purpose of this user-facing web action is unknown.

"a single decoy domain isn't enough to confirm sector or regional targeting on its own"

"We couldn't confirm the delivery vector directly from what was recovered," Beardslee said, giving as his best estimate that, based on how comparable VBS-loader campaigns are typically delivered, the most likely pattern is a phishing email carrying a ZIP or ISO/IMG attachment containing the script.

Removing one of the five footholds leaves four still installed.

The malware backdates several of its own files to January 15, 2024 as an anti-forensic technique, and Beardslee said "that date is fabricated by the attacker to mislead file-timeline review, not evidence of when the real campaign began".

Beardslee said Securonix would need data from outside this one machine to date the campaign, such as registration and DNS history for the two command-server domains, or access to other infected machines.

"Threat actors routinely abuse Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain to blend malicious execution with legitimate administrative activity," the Securonix researchers said.

A batch script, purge.bat, is launched with a two-second delay and likely performs cleanup to erase traces of the activity; its contents have not been recovered, so what it does is unknown.

Akshay Gaikwad and Aaron Beardslee of Securonix Threat Research built their analysis from one infected machine, so Securonix cannot say how many organizations are affected.

Deleting the script from the desktop does nothing to the copy in the Startup folder.

The two modules contain nearly identical code for skipping security-certificate checks.

"It points to a competent-but-not-elite operator," Beardslee said.

"nothing in the sample's code, infrastructure, or TTPs overlaps cleanly with a known APT's established toolkit, so we're not making an attribution claim"

Beardslee said the document-type priority, Word then PDF then PowerPoint then Excel, ahead of archives, "points to corporate-document espionage rather than opportunistic crimeware".

Beardslee recommends blocking or alerting when Windows Script Host runs files from the Desktop, Downloads or Temp folders, restricting Windows Script Host for standard users or allowing only signed scripts, and stripping, sandboxing or blocking ISO, IMG and VBS attachments at the mail gateway.

Securonix's advisory lists the command-server domains, the authentication token and file hashes; organizations can search network logs for the domains, endpoint security tools for the hashes, and, if they inspect encrypted web traffic, proxy logs for the token.