Pwkiller

Overview

HackTool:Win32/Pwkiller (Password Killer) is a specialized utility designed for Credential Access (`T1003`). Unlike general-purpose trojans, Pwkiller focuses exclusively on extracting stored passwords, hashes, and authentication tokens from the infected system. It is often deployed post-compromise by threat actors to facilitate lateral movement across the network.

Understanding Pwkiller
To an end-user, there is no visible impact. For a SOC analyst, the detection of a credential dumper is a critical incident indicating that the attacker has likely gained administrative privileges (required for deep credential extraction) and is actively attempting to escalate privileges or move laterally. Pwkiller tools can target the LSASS memory space, SAM database, or local browser password stores.

Execution and Extraction Mechanics
After gaining initial access and escalating privileges, the attacker drops Pwkiller onto the system. The tool may employ techniques like OS Credential Dumping (`T1003`) by reading the memory of the Local Security Authority Subsystem Service (LSASS.exe) to extract plaintext passwords or NT hashes. It may also target the Security Account Manager (SAM) registry hive (`T1003.002`) or extract saved passwords from web browsers (Chrome, Firefox) and email clients (`T1555.003`). The stolen credentials are then exfiltrated to the attacker's infrastructure.

Indicators of Compromise & Impact
The primary impact is the catastrophic loss of user credentials, enabling the attacker to impersonate legitimate users and bypass security controls. Host-based IoCs include EDR alerts for 'Suspicious Process Accessing LSASS', 'SAM Registry Key Export', or the presence of known credential dumping tools in temporary directories. Network IoCs might include anomalous internal network traffic as the attacker uses the stolen credentials to access other systems (Pass-the-Hash).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1003.002: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PWKILLER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pwkiller"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "pwkiller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Pwkiller (Trojan) Execution & Triage
id: d34f76e6-c852-5390-87ff-857b10a45517
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Pwkiller malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/pwkiller
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1003_001
- attack.t1003_002
- attack.t1555_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_PWKILLER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pwkiller tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "pwkiller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Assume all credentials present on the infected endpoint (including cached domain credentials) are compromised.
2. Immediately force a password reset for any user accounts that logged into the compromised machine.
3. Isolate the endpoint to prevent the attacker from using the stolen credentials for lateral movement.
4. Investigate how the attacker gained the administrative privileges necessary to run the credential dumping tool.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is over just because the Pwkiller tool was deleted; the credentials have already been stolen.
2. Avoid relying solely on local password resets; if domain credentials were stolen, the attacker can access other machines.

References & External Analysis

• Search "pwkiller" on VirusTotal (External Analysis)
• Search "pwkiller" on Any.Run (Sandbox Sandbox)
• Search "pwkiller" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Rewriteboota
• Imqaaem1Agai
• Tpyn
• Fsysna
• Winevar
• Delfidelfi
• Xxybyu
• Genericrxas

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/pwkiller.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.