1. Home
  2. Software
  3. Nidiran

Nidiran

Nidiran is a custom backdoor developed and used by Suckfly. It has been delivered via strategic web compromise. [1]

ID: S0118
ⓘ
Associated Software: Backdoor.Nidiran
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 18 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1543 .003 Create or Modify System Process: Windows Service

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).[2]
Enterprise T1105 Ingress Tool Transfer

Nidiran can download and execute files.[2]
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.[2][3]

Groups That Use This Software

ID Name References
G0039 Suckfly

[1][4]

References

  1. DiMaggio, J.. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016.
  2. Sponchioni, R.. (2016, March 11). Backdoor.Nidiran. Retrieved August 3, 2016.
  1. Microsoft. (2006, October 30). How to use the SysKey utility to secure the Windows Security Accounts Manager database. Retrieved August 3, 2016.
  2. DiMaggio, J.. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.