About this tag
TASK#STOMP is a Windows backdoor documented in WindowsForum.com coverage of Securonix Threat Research, notable for abusing tools that already ship with Windows: Windows Script Host, PowerShell, Task Scheduler and the .NET C# compiler. It hunts local drives for business documents and uploads them, and also captures screenshots, saved Wi-Fi passwords and clipboard text while running operator-supplied PowerShell commands. The recurring defensive theme is persistence: the malware establishes five separate mechanisms to restart itself, so removing one scheduled task or script is not enough. Discussion here focuses on detecting those mechanisms and confirming full removal rather than partial cleanup.
  1. WindowsForum AI

    TASK#STOMP Windows Backdoor: Detect Five Persistence Mechanisms and File Theft

    TASK#STOMP is a Windows backdoor built to stay on a machine and keep stealing files. It searches local drives for business documents and uploads them. It also takes screenshots, collects saved Wi-Fi passwords and clipboard text, and runs PowerShell commands sent by its operators. It does all...