Pwkiller

Overview

HackTool:Win32/Pwkiller (Password Killer) is a specialized utility designed for Credential Access (`T1003`). Unlike general-purpose trojans, Pwkiller focuses exclusively on extracting stored passwords, hashes, and authentication tokens from the infected system. It is often deployed post-compromise by threat actors to facilitate lateral movement across the network.

Understanding Pwkiller
To an end-user, there is no visible impact. For a SOC analyst, the detection of a credential dumper is a critical incident indicating that the attacker has likely gained administrative privileges (required for deep credential extraction) and is actively attempting to escalate privileges or move laterally. Pwkiller tools can target the LSASS memory space, SAM database, or local browser password stores.

Execution and Extraction Mechanics
After gaining initial access and escalating privileges, the attacker drops Pwkiller onto the system. The tool may employ techniques like OS Credential Dumping (`T1003`) by reading the memory of the Local Security Authority Subsystem Service (LSASS.exe) to extract plaintext passwords or NT hashes. It may also target the Security Account Manager (SAM) registry hive (`T1003.002`) or extract saved passwords from web browsers (Chrome, Firefox) and email clients (`T1555.003`). The stolen credentials are then exfiltrated to the attacker's infrastructure.

Indicators of Compromise & Impact
The primary impact is the catastrophic loss of user credentials, enabling the attacker to impersonate legitimate users and bypass security controls. Host-based IoCs include EDR alerts for 'Suspicious Process Accessing LSASS', 'SAM Registry Key Export', or the presence of known credential dumping tools in temporary directories. Network IoCs might include anomalous internal network traffic as the attacker uses the stolen credentials to access other systems (Pass-the-Hash).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1003.002: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PWKILLER {
    meta:
        description = "Detects Pwkiller (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "pwkiller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Pwkiller Activity
id: a5a1da95a8408849a37f2b18a2065325
status: experimental
description: Detects generic indicators of the pwkiller malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*pwkiller*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Assume all credentials present on the infected endpoint (including cached domain credentials) are compromised.
2. Immediately force a password reset for any user accounts that logged into the compromised machine.
3. Isolate the endpoint to prevent the attacker from using the stolen credentials for lateral movement.
4. Investigate how the attacker gained the administrative privileges necessary to run the credential dumping tool.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is over just because the Pwkiller tool was deleted; the credentials have already been stolen.
2. Avoid relying solely on local password resets; if domain credentials were stolen, the attacker can access other machines.

References & External Analysis

• Search "pwkiller" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Msilinj
• Winevar
• Fraudpack
• Pcmega
• Qqshou

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/pwkiller.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.