Skip to content
MalwareWiki

Malware

NirCmd

NirCmd is a benign tool by NirSoft that provides various functionalities.

NirCmd is a Windows malware family.

Background

NirCmd is a legitimate utility from NirSoft offering a wide variety of features. One of them, the ability to launch regedit as SYSTEM, is occasionally leveraged for privilege escalation, and other features can likewise be turned to malicious ends. Because of this, AV engines often flag it.

Source: Malpedia (Fraunhofer FKIE).