{
  "family": "wswhacker",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nWswhacker is a classification assigned to a specific HackTool and dedicated Password Stealer. It is engineered to aggressively extract sensitive authentication data from a compromised Windows workstation, targeting saved credentials in web browsers, local email clients, and FTP software, before silently exfiltrating this intelligence to a remote attacker.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTools like Wswhacker are rarely distributed via automated exploit kits. They are typically deployed manually by a threat actor who has already gained initial access (e.g., via compromised RDP credentials or a reverse shell), or they are bundled within socially engineered, trojanized software packages on file-sharing sites.\n\nOnce executed, Wswhacker is designed for rapid, noisy data extraction:\n<ul>\n<li><strong>Browser and Client Hooking:</strong> The malware immediately targets the local storage databases (SQLite files) and registry keys associated with popular software. It extracts saved plaintext passwords and auto-fill data from Chrome, Firefox, Internet Explorer, Outlook, and FileZilla.</li>\n<li><strong>SAM Database Extraction:</strong> Advanced variants may attempt to dump the Security Account Manager (SAM) database or utilize techniques like Mimikatz (LSASS memory dumping) to extract Windows NTLM hashes for offline cracking or pass-the-hash attacks.</li>\n<li><strong>Automated Exfiltration:</strong> Because Info-stealers do not necessarily need to maintain long-term persistence, Wswhacker quickly bundles the stolen data into a `.txt` or `.zip` file and transmits it to the attacker, often utilizing simple SMTP (email) or FTP protocols.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Wswhacker infection is a critical data breach and a severe indicator of lateral movement capabilities. The immediate theft of local administrator credentials or VPN passwords can lead directly to full domain compromise and massive data exfiltration.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to halt any ongoing data exfiltration and prevent the attacker from utilizing the stolen credentials to pivot to other servers on the LAN.</li>\n<li><strong>Universal Credential Reset:</strong> Assume all passwords saved in the user's browser, local email clients, and the local Windows Administrator account are fully compromised. A comprehensive password reset must be initiated immediately.</li>\n<li><strong>Endpoint Eradication and Investigation:</strong> Utilize enterprise EDR to locate and terminate the Wswhacker process. Crucially, the incident response team must investigate *how* the Wswhacker tool was placed on the system, as its presence often implies a deeper, pre-existing compromise (like a backdoor or vulnerable public-facing service).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.Wswhacker",
    "Trojan.PWS.Wswhacker",
    "Win32/Wswhacker"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003",
    "T1552.001",
    "T1555.003",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:33:16Z",
  "type": "HackTool / Info-Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}