{
  "family": "tasker",
  "sample_count": 36,
  "category": "trojan",
  "description": "Tasker (identified across endpoint security databases and threat intelligence reports as Trojan:Win32/Tasker, Backdoor:Win32/Tasker, and Trojan.Tasker) is a stealthy Windows trojan and initial access backdoor active since 2017 that specializes in abusing the native Windows Task Scheduler subsystem. Infiltrating environments via weaponized spear-phishing emails or cracked software installers, Tasker leverages the Task Scheduler API (ITaskService COM interfaces or schtasks.exe) to create obfuscated, high-privilege scheduled tasks disguised under names of legitimate operating system tasks (such as Windows Defender updates or disk optimization routines). Through these scheduled triggers, Tasker maintains resilient persistence that survives system reboots, establishes encrypted HTTP/HTTPS command-and-control communication, performs endpoint surveillance, and periodically downloads secondary ransomware or infostealer modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Tasker",
    "Backdoor:Win32/Tasker",
    "Trojan.Tasker",
    "Win32/Tasker",
    "Trojan:Win32/Tasker.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Tasker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tasker is a Windows trojan and backdoor that establishes persistence and executes malicious code by creating deceptive Windows Scheduled Tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tasker abuse the Windows Task Scheduler?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It interfaces with the ITaskService API to register recurring tasks masquerading as legitimate Windows maintenance routines, executing with SYSTEM privileges."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Tasker possess once active?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tasker provides remote command execution, captures host system information, and downloads secondary payloads such as ransomware and infostealers."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect malicious scheduled tasks created by Tasker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor Windows Security Event ID 4698 (A scheduled task was created) and inspect the TaskCache registry keys for unregistered or disguised task entries."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps are required for a Tasker infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Delete unauthorized scheduled tasks using schtasks /delete, remove malicious startup registry keys, terminate injected processes, and run a complete malware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1053.005",
    "T1071.001",
    "T1055",
    "T1036.005",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Documents",
    "Compromised Utility Bundlers",
    "Malvertising Redirects"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows 7"
  ],
  "capabilities": [
    "Abuse of Windows Task Scheduler",
    "SYSTEM-Level Privilege Escalation",
    "Encrypted HTTPS C2 Beaconing",
    "Process Injection into svchost.exe",
    "Secondary Payload Ingestion"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Task XML Definition",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Periodic HTTP POST requests to remote C2 endpoints sending encrypted system architecture and task execution status",
      "Direct downloads of secondary stage binary payloads masquerading as CAB or JPG files"
    ],
    "evasion_techniques": [
      "Hiding task definitions directly inside the Windows registry at HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree without registering via schtasks CLI",
      "Masquerading binary names as official Microsoft update utilities"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "1728394a5b6c7d8e9f0123456789abcdef012345",
      "28394a5b6c7d8e9f0123456789abcdef01234567"
    ],
    "registry_keys": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\Maintenance\\WinTasker",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TaskerAgent"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\Tasks\\Microsoft\\Windows\\Maintenance\\WinTasker",
      "%AppData%\\Tasker\\taskersvc.exe",
      "%Temp%\\tsk_cache.dat"
    ]
  },
  "defensive_measures": [
    "Enable auditing for Scheduled Task creation (Windows Event ID 4698 and 4702) in SIEM environments",
    "Implement EDR detections for suspicious processes invoking schtasks.exe with encoded arguments",
    "Restrict regular user permissions from creating scheduled tasks that run with elevated SYSTEM tokens"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Tasker",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Tasker"
    },
    {
      "name": "MITRE ATT&CK - Technique T1053.005 Scheduled Task",
      "url": "https://attack.mitre.org/techniques/T1053/005/"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Tasker.A",
      "Trojan:Win32/Tasker.B"
    ]
  },
  "motivation": "Privilege Escalation, Stealth Persistence & Remote Payload Staging",
  "sample_hashes": []
}