DeadCow
Copyright © MegaSecurity
By ?
Informations
| Author | ? |
| Family | DeadCow |
| Category | Remote Access |
| Version | DeadCow |
| Language | Delphi,compressed with ASPack |
Additional Information
Server:
dropped file:
C:\WINDOWS\Vbrun600.exe
size: 158,208 bytes
port: 1987 TCP
startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft Visual Basic Runtime
following url's can be found in the binary:
http://www.extra.hu/deadcow/deadcow.bin
http://www.tar.hu/deadcow/deadcow.bin
probably related to Backdoor.Win32.FeriIf you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.