Loading malware…
Winexe is a remote execution utility that executes commands or binaries on Windows systems by installing a temporary service on a remote host, running the specified command, and then uninstalling the service. The provided content explicitly describes this service-based execution behavior and notes its use as a PsExec-like tool for remote service execution and lateral movement. It is associated in the content with the Silence threat actor, which used Winexe to install a service on remote systems, and it is also referenced in DarkVishnya intrusion activity, where attackers used Impacket together with winexesvc.exe or psexec.exe to run executable files remotely when PowerShell or allowlisting controls blocked other execution paths. High-confidence behavioral details from the content are limited to remote service installation, command execution, and service removal; no specific standalone infection vector, platform beyond Windows remote service execution, or unique IOC set for Winexe itself is provided.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Winexe installs a service on the remote system, executes the command, then uninstalls the service.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Our investigation into the two incidents where The Gentlemen was deployed revealed several commonalities in TTPs, including the use of Scheduled Tasks and PowerShell.
"Anchor can create and execute services to load its payload"; "APT32's backdoor has used Windows services as a way to execute its malicious payload"; "Ragnar Locker has used sc.exe to execute a service that it creates"; "Shamoon creates a new service named 'ntssrv' to execute the payload"
Virtual servers had their VMDKs encrypted... Physical servers, meanwhile, were encrypted at the operating system level, using a conveniently named win.exe
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote execution tool used to launch executables on Windows hosts across the network as an alternative to PowerShell-based execution.
Remote execution tool that runs commands by installing a temporary Windows service on a remote host and removing it afterward.
Remote execution utility used to execute commands/install services on remote Windows systems, supporting lateral movement and remote service execution.
Remote execution utility that runs commands by temporarily installing a service on a remote Windows system.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.