{
  "family": "pwkiller",
  "sample_count": 1,
  "category": "trojan",
  "description": "HackTool:Win32/Pwkiller (Password Killer) is a specialized utility designed for Credential Access (`T1003`). Unlike general-purpose trojans, Pwkiller focuses exclusively on extracting stored passwords, hashes, and authentication tokens from the infected system. It is often deployed post-compromise by threat actors to facilitate lateral movement across the network.<br><br><b>Understanding Pwkiller</b><br>To an end-user, there is no visible impact. For a SOC analyst, the detection of a credential dumper is a critical incident indicating that the attacker has likely gained administrative privileges (required for deep credential extraction) and is actively attempting to escalate privileges or move laterally. Pwkiller tools can target the LSASS memory space, SAM database, or local browser password stores.<br><br><b>Execution and Extraction Mechanics</b><br>After gaining initial access and escalating privileges, the attacker drops Pwkiller onto the system. The tool may employ techniques like OS Credential Dumping (`T1003`) by reading the memory of the Local Security Authority Subsystem Service (LSASS.exe) to extract plaintext passwords or NT hashes. It may also target the Security Account Manager (SAM) registry hive (`T1003.002`) or extract saved passwords from web browsers (Chrome, Firefox) and email clients (`T1555.003`). The stolen credentials are then exfiltrated to the attacker's infrastructure.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic loss of user credentials, enabling the attacker to impersonate legitimate users and bypass security controls. Host-based IoCs include EDR alerts for 'Suspicious Process Accessing LSASS', 'SAM Registry Key Export', or the presence of known credential dumping tools in temporary directories. Network IoCs might include anomalous internal network traffic as the attacker uses the stolen credentials to access other systems (Pass-the-Hash).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003.001",
    "T1003.002",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Extracting hashes/passwords from memory)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1003.002",
      "name": "OS Credential Dumping: Security Account Manager (Dumping the SAM hive)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Assume all credentials present on the infected endpoint (including cached domain credentials) are compromised.",
    "Immediately force a password reset for any user accounts that logged into the compromised machine.",
    "Isolate the endpoint to prevent the attacker from using the stolen credentials for lateral movement.",
    "Investigate how the attacker gained the administrative privileges necessary to run the credential dumping tool."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over just because the Pwkiller tool was deleted; the credentials have already been stolen.",
    "Avoid relying solely on local password resets; if domain credentials were stolen, the attacker can access other machines."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}