Shutdowner

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Forced System State Change: The script (often a simple batch file invoking `shutdown.exe -s -f -t 0` or a small compiled executable calling the `ExitWindowsEx` API) forces the operating system to immediately power down or reboot.
• Bypassing User Prompts: The "-f" flag (force) is almost universally used, meaning any unsaved work in open applications is instantly destroyed without prompting the user to save.
• Anti-Forensic Utility: Attackers sometimes deploy a Shutdowner script immediately after executing a primary payload (like dropping a backdoor). The forced reboot clears volatile memory (RAM), destroying potential forensic evidence of the initial infection vector before incident responders can capture it.

Threat Assessment

Incident Response and Remediation

• Investigate the Source (Critical): The primary focus must be determining *how* the script was executed. Check Windows Event Logs (specifically Security logs for logon events and System logs for scheduled tasks or service creations) to identify the attacker's entry point.
• Disable Scheduled Tasks/Run Keys: Check if the Shutdowner has established persistence (e.g., executing on every boot to create a permanent denial of service loop). Remove any associated registry keys or scheduled tasks.
• Assume Broader Compromise: Do not treat the shutdown as an isolated prank. Assume the attacker deployed other, stealthier malware before initiating the shutdown. A thorough forensic sweep of the endpoint is required.

Known aliases

Threat reports may refer to this family under multiple names:

• HackTool.Shutdowner
• Riskware.Shutdown
• Win32/DoS.Shutdown

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1529

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SHUTDOWNER {
    meta:
        description = "Detects Shutdowner (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "shutdowner" ascii wide nocase
        $s2 = "hacktool.shutdowner" ascii wide nocase
        $s3 = "riskware.shutdown" ascii wide nocase
        $s4 = "win32/dos.shutdown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Shutdowner Activity
id: 3029a62e7bbec6bc2bb119134cfaf70d
status: experimental
description: Detects generic indicators of the shutdowner malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*shutdowner*"
            - "*hacktool.shutdowner*"
            - "*riskware.shutdown*"
            - "*win32/dos.shutdown*"
    condition: selection
level: medium

References & External Analysis

• Search "shutdowner" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Teamspy
• Orcusrot
• Adduser
• Winnti
• Pterodo

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/shutdowner.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.