Passview

Overview

HackTool:Win32/Passview (or generic **NirSoft Password Recovery Abuse** heuristics) refers to the detection of legitimate, powerful system administration utilities—specifically password recovery tools developed by NirSoft (like WebBrowserPassView, MailPassView, or WirelessKeyView)—that are actively being abused by threat actors or insider threats. While these tools are designed to help IT administrators recover lost passwords, their ability to instantly dump plaintext credentials makes them highly prized weapons during the post-exploitation phase of a cyberattack.

Understanding Passview Abuse
To an end-user, these tools run completely silently in the background. For a security analyst, the unapproved presence of a Passview utility on a corporate endpoint is a 'code red' credential compromise event. These utilities do not crack passwords; they simply query the local SQLite databases or LSA secrets where Windows and web browsers securely store cached credentials and export them into a neat plaintext `.csv` or `.txt` file.

Execution and Credential Dumping Mechanics
Attackers drop Passview utilities after they have already gained initial access (`T1105`) and established a foothold on the machine. Because these are standalone, portable executables, they do not require installation. The attacker executes the tool via a command-line script (`T1059.003`), passing arguments to force the tool to run silently (e.g., `/stext`) and output the dumped passwords to a hidden file (`T1555.003`). The tool rapidly extracts saved passwords from Chrome, Firefox, Outlook, and the Windows Wireless Manager (`T1555`). The attacker then exfiltrates the plaintext output file (`T1041`) and deletes the tool to cover their tracks.

Indicators of Compromise & Impact
The impact is the total compromise of all credentials saved on the endpoint, leading to Account Takeover (ATO) and lateral movement across the network. The primary IoC is the execution of known NirSoft binaries (e.g., `WebBrowserPassView.exe`) or their associated MD5/SHA256 hashes, often executed from unusual directories like `%Temp%` or `C:\PerfLogs`. EDR logs will flag command-line executions containing arguments like `/stext` or `/shtml` associated with these binaries. The sudden creation of plaintext `.txt` files containing account names and passwords in temporary directories is a definitive sign of successful dumping.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PASSVIEW {
    meta:
        description = "Detects Passview (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "passview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Passview Activity
id: 0f5fda4031cab1a6f763f42cd6cd5590
status: experimental
description: Detects generic indicators of the passview malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*passview*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; the presence of this tool indicates an attacker already has interactive or remote execution capabilities on the machine.
2. Assume total credential compromise. Enforce a mandatory, immediate password reset for *every* account saved in the user's browser, email client, and VPN.
3. Perform a deep forensic review to identify the initial entry vector that allowed the attacker to drop and execute the HackTool.
4. Implement Application Control (like Windows AppLocker) to explicitly block the execution of known password recovery utilities by non-administrative users.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not dismiss the alert as a 'false positive' simply because NirSoft tools are technically legitimate; if IT did not explicitly authorize its use, it is a severe breach.
2. Avoid closing the incident after simply deleting the tool; the passwords have already been exfiltrated.

References & External Analysis

• Search "passview" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Purityscan
• Dotbundle
• Superspy
• Zylom
• Allinonekeylogger

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/passview.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.