Passview

Overview

HackTool:Win32/Passview (or generic **NirSoft Password Recovery Abuse** heuristics) refers to the detection of legitimate, powerful system administration utilities—specifically password recovery tools developed by NirSoft (like WebBrowserPassView, MailPassView, or WirelessKeyView)—that are actively being abused by threat actors or insider threats. While these tools are designed to help IT administrators recover lost passwords, their ability to instantly dump plaintext credentials makes them highly prized weapons during the post-exploitation phase of a cyberattack.

Understanding Passview Abuse
To an end-user, these tools run completely silently in the background. For a security analyst, the unapproved presence of a Passview utility on a corporate endpoint is a 'code red' credential compromise event. These utilities do not crack passwords; they simply query the local SQLite databases or LSA secrets where Windows and web browsers securely store cached credentials and export them into a neat plaintext `.csv` or `.txt` file.

Execution and Credential Dumping Mechanics
Attackers drop Passview utilities after they have already gained initial access (`T1105`) and established a foothold on the machine. Because these are standalone, portable executables, they do not require installation. The attacker executes the tool via a command-line script (`T1059.003`), passing arguments to force the tool to run silently (e.g., `/stext`) and output the dumped passwords to a hidden file (`T1555.003`). The tool rapidly extracts saved passwords from Chrome, Firefox, Outlook, and the Windows Wireless Manager (`T1555`). The attacker then exfiltrates the plaintext output file (`T1041`) and deletes the tool to cover their tracks.

Indicators of Compromise & Impact
The impact is the total compromise of all credentials saved on the endpoint, leading to Account Takeover (ATO) and lateral movement across the network. The primary IoC is the execution of known NirSoft binaries (e.g., `WebBrowserPassView.exe`) or their associated MD5/SHA256 hashes, often executed from unusual directories like `%Temp%` or `C:\PerfLogs`. EDR logs will flag command-line executions containing arguments like `/stext` or `/shtml` associated with these binaries. The sudden creation of plaintext `.txt` files containing account names and passwords in temporary directories is a definitive sign of successful dumping.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PASSVIEW_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passview"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "passview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Passview (Advanced Threat) Execution & Triage
id: fcd76902-5af9-58bb-b829-1179aa3c3ab8
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Passview malware family. Detects proxy execution, reflective DLL loading,
  and remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/passview
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1555
- attack.t1059_003
- attack.t1105
- attack.t1555_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \rundll32.exe
    - \regsvr32.exe
    CommandLine|contains:
    - DownloadString
    - IEX(
    - '/s /n /u /i:'
    - sc create
    - start-process
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_PASSVIEW_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passview tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "passview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; the presence of this tool indicates an attacker already has interactive or remote execution capabilities on the machine.
2. Assume total credential compromise. Enforce a mandatory, immediate password reset for *every* account saved in the user's browser, email client, and VPN.
3. Perform a deep forensic review to identify the initial entry vector that allowed the attacker to drop and execute the HackTool.
4. Implement Application Control (like Windows AppLocker) to explicitly block the execution of known password recovery utilities by non-administrative users.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not dismiss the alert as a 'false positive' simply because NirSoft tools are technically legitimate; if IT did not explicitly authorize its use, it is a severe breach.
2. Avoid closing the incident after simply deleting the tool; the passwords have already been exfiltrated.

References & External Analysis

• Search "passview" on VirusTotal (External Analysis)
• Search "passview" on Any.Run (Sandbox Sandbox)
• Search "passview" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Advanced Threat)

Explore other documented threats in the same operational category:

• Xiaoxiong
• Pswdump
• Nicehashminer
• Silentinstall
• Fakesysdef
• Monder
• Zacinlo
• Refogkeylogging

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/passview.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.