Loading malware…
pwdump is a Windows credential-dumping utility used to extract password hashes from the Security Account Manager (SAM) database and related credential stores. It is commonly referenced alongside other credential-access tools such as Mimikatz, gsecdump, and fgdump, and has been used both as an off-the-shelf administrative or offensive utility and in customized variants adapted by intrusion operators.
The tool is associated with credential theft on Windows systems, particularly the dumping of local account password hashes from SAM for offline cracking or follow-on authentication abuse. Reporting also describes customized pwdump variants used to dump cached Windows credentials by injecting into the Local Security Authority Subsystem Service process. This places pwdump within the broader family of post-compromise credential-access tooling rather than initial-access malware.
pwdump has been observed in operations attributed to multiple state-linked espionage actors, including Chafer and APT10, and customized forms have been associated with APT3 tradecraft. In those contexts it was used after compromise to harvest credentials that could support privilege escalation, lateral movement, and persistence across victim environments. Its use has been documented in enterprise intrusions targeting sectors such as telecommunications and other high-value organizational networks.
pwdump targets Microsoft Windows environments and is best characterized as a credential-dumping utility used during post-exploitation to obtain password material from compromised hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Chafer has also continued to use tools previously associated with the group, including its own custom backdoor Remexi; the aforementioned PsExec; Mimikatz; Pwdump (Pwdump) a tool that is used to grab Windows password hashes from a remote Windows computer.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential dumping tool listed in protections against Chafer attacks.
Password dumping tool referenced in the context of exporting credentials during post-compromise activity.
Credential dumping tool family referenced for extracting Windows password hashes/credentials.
A password hash dumping tool used by Chafer to extract Windows password hashes from remote systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.