Malware

pngdowner

pngdowner is a Windows malware family that communicates with command-and-control infrastructure over HTTP. It includes logic to support operation in proxied enterprise environments: when an initial connectivity check fails, it attempts to recover proxy configuration details and associated credentials from Windows Protected Storage and the Internet Explorer Credentials Store, then uses those credentials to enable subsequent outbound HTTP communications where proxy authentication is required. The malware has also been observed deleting content from command-and-control communications after that content is saved to the user temporary directory, indicating cleanup and anti-forensic behavior. The documented behavior supports characterization of pngdowner as a credential-stealing implant with command-and-control and defense-evasion functionality on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1070.004File DeletionEvidence8

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence1

T1555Credentials from Password StoresEvidence3

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Downloader malware that deletes saved C2 communication content from temporary storage.

mitre attack websiteNews

Mar 7, 2018

Unsecured Credentials: Credentials In Files, Sub-technique T1552.001 - Enterprise | MITRE ATT&CK®

Backdoor that can extract proxy details and credentials from Windows Protected Storage and Internet Explorer credential storage to enable outbound access.

mitre attack websiteNews

Mar 7, 2018

Unsecured Credentials: Credentials In Files, Sub-technique T1552.001 - Enterprise | MITRE ATT&CK®

Backdoor that extracts proxy details and credentials from Windows Protected Storage and the IE Credentials Store to enable outbound access.

mitre attackNews

Jan 25, 2026

Application Layer Protocol: Web Protocols, Sub-technique T1071.001 - Enterprise | MITRE ATT&CK®

Malware that uses HTTP for command-and-control (C2).

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

pngdowner