Its decoded payloads search local drives, watch for new files, and send collected data to two command-and-control servers. The malware can also capture screenshots, steal saved Wi-Fi passwords and clipboard text, and execute commands from an operator.
The observed chain begins when Windows Script Host runs a VBScript file from a user’s desktop. Researchers have not established how the file arrived, so its initial delivery method remains unknown.
The script creates four scheduled tasks from XML files under LOCALAPPDATA and places msdiag.vbs in the user’s Startup folder. Together, these mechanisms can relaunch the malware after sign-in or a restart.
TASK#STOMP Backdoor Steals Documents
The installer stages files in a folder named WinDefendSvc, a name that resembles a Windows security component. It launches two hidden PowerShell scripts, sysloader.ps1 and winconn.ps1, after terminating older instances.
It also changes the modification times of five staged files to January 15, 2024, making them appear older than the observed activity.
Each script reads a Base64-encoded DAT file, decodes its PowerShell payload, and executes it in memory. The primary payload, diagpack.dat, handles document collection and surveillance.
The secondary payload, winconncfg.dat, maintains a separate remote-access channel. The modules can restart one another, although researchers found a coding flaw that prevents one additional watchdog check from normally running.
The scheduled tasks and Startup script provide persistence independently of that check. Both PowerShell processes also compile small C helpers through the legitimate csc.exe compiler.
These helpers disable TLS certificate validation, letting the malware connect even when a server presents an invalid or mismatched certificate.
The backdoor’s main functions remain inside PowerShell; the compiled helpers support its network connections.
TASK#STOMP scans fixed drives for Word, PDF, PowerPoint, Excel, and archive files created or modified within the previous 365 days.
It skips files larger than 500 MB, tracks completed uploads, and retries failed transfers. After the initial scan, a filesystem watcher detects matching files as they are created or changed, enabling continuous collection.
The modules communicate with corecloudfileshare.xyz and attachmentsharingdrive.xyz, switching between them if a request fails.
An operator can request screenshots, saved Wi-Fi keys, clipboard contents, and system information. The backdoor can also execute arbitrary PowerShell commands, extending its capabilities beyond document theft, securonix said.
Defenders should investigate chains in which VBScript launches schtasks.exe, followed by hidden PowerShell running from AppData and spawning csc.exe.
PowerShell logs, scheduled-task XML, staged DAT files, and traffic to the two identified domains can help establish the scope of an infection.
Responders should preserve those artifacts before removing all scheduled tasks, the Startup script, and both payload branches together. Removing only one persistence mechanism may leave another available to restart the backdoor.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
