Submit #14429: Backdoor.Win32.Zombam.gen / Remote Stack Buffer Overflowinfo

TitleBackdoor.Win32.Zombam.gen / Remote Stack Buffer Overflow
DescriptionDiscovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/ff6516c881dee555b0cd253408b64404_C.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.gen Vulnerability: Remote Stack Buffer Overflow Description: Zombam malware listens on TCP port 80 to display an HTML Web UI for basic remote administration capability. Third-party attackers who can reach an infected system can make an HTTP GET request sending a long string to trigger a buffer overflow overwriting the EDX register. Type: PE32 MD5: ff6516c881dee555b0cd253408b64404 Vuln ID: MVID-2021-0245 Disclosure: 06/10/2021 Memory Dump: (af4.1a48): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=0287fa20 edx=41414141 esi=00000003 edi=00000003 eip=7725ed3c esp=0287f0bc ebp=0287f24c iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202 ntdll!ZwWaitForMultipleObjects+0xc: 7725ed3c c21400 ret 14h 0:005> .ecxr eax=0287f9f0 ebx=04170280 ecx=0287fa20 edx=41414141 esi=04170280 edi=00405366 eip=004029c0 esp=0287f9d8 ebp=0287fa28 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 *** WARNING: Unable to verify checksum for Backdoor.Win32.Zombam.gen.ff6516c881dee555b0cd253408b64404.exe *** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Zombam.gen.ff6516c881dee555b0cd253408b64404.exe Backdoor_Win32_Zombam_gen_ff6516c881dee555b0cd253408b64404+0x29c0: 004029c0 8b4204 mov eax,dword ptr [edx+4] ds:002b:41414145=???????? 0:005> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* FAULTING_IP: Backdoor_Win32_Zombam_gen_ff6516c881dee555b0cd253408b64404+29c0 004029c0 8b4204 mov eax,dword ptr [edx+4] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 004029c0 (Backdoor_Win32_Zombam_gen_ff6516c881dee555b0cd253408b64404+0x000029c0) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 41414145 Attempt to read from address 41414145 PROCESS_NAME: Backdoor.Win32.Zombam.gen.ff6516c881dee555b0cd253408b64404.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 41414145 READ_ADDRESS: 41414145 FOLLOWUP_IP: Backdoor_Win32_Zombam_gen_ff6516c881dee555b0cd253408b64404+29c0 004029c0 8b4204 mov eax,dword ptr [edx+4] MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 00001a48 BUGCHECK_STR: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: STRING_DEREFERENCE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: STRING_DEREFERENCE_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 00402554 to 004029c0 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 0287fa28 00402554 41414141 0287fa40 00000415 Backdoor_Win32_Zombam_gen_ff6516c881dee555b0cd253408b64404+0x29c0 0287faa4 41414141 41414141 41414141 41414141 Backdoor_Win32_Zombam_gen_ff6516c881dee555b0cd253408b64404+0x2554 0287faa8 41414141 41414141 41414141 41414141 0x41414141 0287faac 41414141 41414141 41414141 41414141 0x41414141 0287fab0 41414141 41414141 41414141 41414141 0x41414141 0287fab4 41414141 41414141 41414141 41414141 0x41414141 0287fab8 41414141 41414141 41414141 41414141 0x41414141 0287fabc 41414141 41414141 41414141 41414141 0x41414141 0287fac0 41414141 41414141 41414141 41414141 0x41414141 0287fac4 41414141 41414141 41414141 41414141 0x41414141 0287fac8 41414141 41414141 41414141 41414141 0x41414141 0287facc 41414141 41414141 41414141 41414141 0x41414141 0287fad0 41414141 41414141 41414141 41414141 0x41414141 0287fad4 41414141 41414141 41414141 41414141 0x41414141 0287fad8 41414141 41414141 41414141 41414141 0x41414141 0287fadc 41414141 41414141 41414141 41414141 0x41414141 0287fae0 41414141 41414141 41414141 41414141 0x41414141 0287fae4 41414141 41414141 41414141 41414141 0x41414141 0287fae8 41414141 41414141 41414141 41414141 0x41414141 0287faec 41414141 41414141 41414141 41414141 0x41414141 0287faf0 41414141 41414141 41414141 41414141 0x41414141 0287faf4 41414141 41414141 41414141 41414141 0x41414141 0287faf8 41414141 41414141 41414141 41414141 0x41414141 0287fafc 41414141 41414141 41414141 41414141 0x41414141 0287fb00 41414141 41414141 41414141 41414141 0x41414141 0287fb04 41414141 41414141 41414141 41414141 0x41414141 0287fb08 41414141 41414141 41414141 41414141 0x41414141 0287fb0c 41414141 41414141 41414141 41414141 0x41414141 0287fb10 41414141 41414141 41414141 41414141 0x41414141 0287fb14 41414141 41414141 41414141 41414141 0x41414141 0287fb18 41414141 41414141 41414141 41414141 0x41414141 0287fb1c 41414141 41414141 41414141 41414141 0x41414141 0287fb20 41414141 41414141 41414141 41414141 0x41414141 0287fb24 41414141 41414141 41414141 41414141 0x41414141 0287fb28 41414141 41414141 41414141 41414141 0x41414141 0287fb2c 41414141 41414141 41414141 41414141 0x41414141 0287fb30 41414141 41414141 41414141 41414141 0x41414141 0287fb34 41414141 41414141 41414141 41414141 0x41414141 0287fb38 41414141 41414141 41414141 41414141 0x41414141 0287fb3c 41414141 41414141 41414141 41414141 0x41414141 0287fb40 41414141 41414141 41414141 41414141 0x41414141 0287fb44 41414141 41414141 41414141 41414141 0x41414141 0287fb48 41414141 41414141 41414141 41414141 0x41414141 0287fb4c 41414141 41414141 41414141 41414141 0x41414141 0287fb50 41414141 41414141 41414141 41414141 0x41414141 0287fb54 41414141 41414141 41414141 41414141 0x41414141 0287fb58 41414141 41414141 41414141 41414141 0x41414141 0287fb5c 41414141 41414141 41414141 41414141 0x41414141 0287fb60 41414141 41414141 41414141 41414141 0x41414141 0287fb64 41414141 41414141 41414141 41414141 0x41414141 0287fb68 41414141 41414141 41414141 41414141 0x41414141 0287fb6c 41414141 41414141 41414141 41414141 0x41414141 0287fb70 41414141 41414141 41414141 41414141 0x41414141 0287fb74 41414141 41414141 41414141 41414141 0x41414141 0287fb78 41414141 41414141 41414141 41414141 0x41414141 0287fb7c 41414141 41414141 41414141 41414141 0x41414141 0287fb80 41414141 41414141 41414141 41414141 0x41414141 0287fb84 41414141 41414141 41414141 41414141 0x41414141 0287fb88 41414141 41414141 41414141 41414141 0x41414141 0287fb8c 41414141 41414141 41414141 41414141 0x41414141 0287fb90 41414141 41414141 41414141 41414141 0x41414141 0287fb94 41414141 41414141 41414141 41414141 0x41414141 0287fb98 41414141 41414141 41414141 41414141 0x41414141 0287fb9c 41414141 41414141 41414141 41414141 0x41414141 0287fba0 41414141 41414141 41414141 41414141 0x41414141 0287fba4 41414141 41414141 41414141 41414141 0x41414141 0287fba8 41414141 41414141 41414141 41414141 0x41414141 0287fbac 41414141 41414141 41414141 41414141 0x41414141 0287fbb0 41414141 41414141 41414141 41414141 0x41414141 0287fbb4 41414141 41414141 41414141 41414141 0x41414141 0287fbb8 41414141 41414141 41414141 41414141 0x41414141 0287fbbc 41414141 41414141 41414141 41414141 0x41414141 0287fbc0 41414141 41414141 41414141 41414141 0x41414141 0287fbc4 41414141 41414141 41414141 41414141 0x41414141 0287fbc8 41414141 41414141 41414141 41414141 0x41414141 0287fbcc 41414141 41414141 41414141 41414141 0x41414141 0287fbd0 41414141 41414141 41414141 41414141 0x41414141 0287fbd4 41414141 41414141 41414141 41414141 0x41414141 0287fbd8 41414141 41414141 41414141 41414141 0x41414141 0287fbdc 41414141 41414141 41414141 41414141 0x41414141 0287fbe0 41414141 41414141 41414141 41414141 0x41414141 0287fbe4 41414141 41414141 41414141 41414141 0x41414141 0287fbe8 41414141 41414141 41414141 41414141 0x41414141 0287fbec 41414141 41414141 41414141 41414141 0x41414141 0287fbf0 41414141 41414141 41414141 41414141 0x41414141 0287fbf4 41414141 41414141 41414141 41414141 0x41414141 0287fbf8 41414141 41414141 41414141 41414141 0x41414141 0287fbfc 41414141 41414141 41414141 41414141 0x41414141 0287fc00 41414141 41414141 41414141 41414141 0x41414141 0287fc04 41414141 41414141 41414141 41414141 0x41414141 0287fc08 41414141 41414141 41414141 41414141 0x41414141 0287fc0c 41414141 41414141 41414141 41414141 0x41414141 0287fc10 41414141 41414141 41414141 41414141 0x41414141 0287fc14 41414141 41414141 41414141 41414141 0x41414141 0287fc18 41414141 41414141 41414141 41414141 0x41414141 0287fc1c 41414141 41414141 41414141 41414141 0x41414141 0287fc20 41414141 41414141 41414141 41414141 0x41414141 0287fc24 41414141 41414141 41414141 41414141 0x41414141 0287fc28 41414141 41414141 41414141 41414141 0x41414141 0287fc2c 41414141 41414141 41414141 41414141 0x41414141 0287fc30 41414141 41414141 41414141 41414141 0x41414141 0287fc34 41414141 41414141 41414141 41414141 0x41414141 0287fc38 41414141 41414141 41414141 41414141 0x41414141 0287fc3c 41414141 41414141 41414141 41414141 0x41414141 0287fc40 41414141 41414141 41414141 41414141 0x41414141 0287fc44 41414141 41414141 41414141 41414141 0x41414141 0287fc48 41414141 41414141 41414141 41414141 0x41414141 0287fc4c 41414141 41414141 41414141 41414141 0x41414141 0287fc50 41414141 41414141 41414141 41414141 0x41414
Source⚠️ https://www.malvuln.com/advisory/ff6516c881dee555b0cd253408b64404_C.txt
User
 malvuln (UID 14984)
Submission06/11/2021 04:19 (5 years ago)
Moderation06/11/2021 09:59 (6 hours later)
StatusAccepted
VulDB entry176829 [Backdoor.Win32.Zombam.gen HTML Web UI buffer overflow]
Points20

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!