CyberSpy 8.0 - Malware Gallery

Informations

Author	Ghirai
Family	CyberSpy
Category	Remote Access
Version	CyberSpy 8.0
Released Date	Oct 2001, 22 years, 11 months ago.
Language	Visual Basic

Additional Information

Server:
dropped file:
C:\WINDOWS\SYSTEM\MSGSVR16.EXE.EXE

size: 55.156 bytes

port: 200 TCP

startup:
c:\windows\system.ini
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Author Information / Description

<<[  CyberSpy v8.0 Telnet Release (c)oded by Ghirai  ]>>
        
                                        <<Documentation>>

INTRODUCTION

-CS  is a Telnet-based trojan; it means that you don't need any client to connect.
you just use your favourite terminal.

TECHINICAL INFO

-it's written in VB6 and uses winsock, so if you get an error running the file, you
can find the runtimes on the site(most of the people have these files)
-the server listens on PORT 200 for a connection, therefore set the remote port in your
terminal to 200...
-it has a total of 47 commands; to see a list of the commands, type "help", and to see what a
command does,  type "help command" (without the quotation marks); it's very simple to use...
-the commands are listed alphabetically, so you can find what you need quicker
-no need to list the commands here, you'll see them when you type help...
-the size of the server should be 90,5KB, you can rename it to anything you want,
just leave a exe extension.
-it supports multiple clients

TIP

-when connecting to someone, first thing you should do is get the passwords, by typing "passwords".

 'greets, Ghirai.