Pswtool

Overview

HackTool:Win32/Pswtool is a broad heuristic classification for dual-use password recovery utilities (such as NirSoft's WebBrowserPassView, mimikatz, or pwdump). While legitimately used by sysadmins to recover lost credentials, these tools are routinely hijacked by Advanced Persistent Threats (APTs) and ransomware operators as part of their credential harvesting and lateral movement toolset.

Understanding Pswtool Classifications
To an end-user, Pswtool executables are usually invisible, dropped in the background during an attack. For incident responders, the detection of a Pswtool is a massive red flag. It indicates that an attacker has gained initial access, established a foothold, and is actively executing the 'Credential Access' phase of the attack lifecycle. These tools do not exploit zero-days; they abuse legitimate Windows features, APIs, and poorly secured local data stores (like browser profiles) to extract plaintext passwords or NTLM hashes.

Execution and Credential Harvesting
Attackers typically deploy Pswtools after establishing initial access via spearphishing or exploiting a vulnerable public-facing service (`T1190`). Once inside, they use living-off-the-land techniques to execute the tool, often loading it directly into memory (`T1620`) to evade static AV signatures. The tools function by dumping LSASS memory (`T1003.001`), decrypting stored credentials in web browsers (`T1555.003`), or extracting saved Wi-Fi and VPN passwords from the registry. These credentials are then exfiltrated and used to perform privilege escalation or lateral movement across the network (`T1021`).

Indicators of Compromise & Impact
The impact is the compromise of enterprise credentials, often leading to Domain Admin access and full network compromise. EDR platforms must alert on any process attempting to access the `lsass.exe` memory space or aggressively reading browser SQLite databases. Identifying the execution of known dual-use utilities in temporary directories (`%Temp%` or `C:\PerfLogs`) is a strong indicator of unauthorized use.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PSWTOOL {
    meta:
        description = "Detects Pswtool (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "pswtool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Pswtool Activity
id: a48544c6069bd37b4a37e38974b4d852
status: experimental
description: Detects generic indicators of the pswtool malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*pswtool*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint where the Pswtool was detected; assume the local administrator credentials have been compromised.
2. Initiate an enterprise-wide password reset for any user accounts that had active sessions on the compromised machine.
3. Review Windows Event Logs (specifically Event ID 4624) to track lateral movement originating from the compromised host.
4. Ensure LSA Protection (RunAsPPL) and Windows Defender Credential Guard are enabled enterprise-wide to mitigate future LSASS dumping attacks.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is over simply because the AV quarantined the password dumper; the attacker may have already successfully exfiltrated the hashes.
2. Avoid relying solely on local administrator passwords that are shared across endpoints; this allows attackers to pivot immediately.

References & External Analysis

• Search "pswtool" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Goodpic
• Nussamoc
• Ryzerlo
• Conjar
• Fakeie

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/pswtool.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.