MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Havoc


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
SHA3-384 hash: d116393c395f82b099ae291d7b6a654e89d30cc665bac5182786a2f9918023569ce36e05890900670dec9917b5a44b8b
SHA1 hash: 660c61332dd7d895bb1ef6ea15b0fe295280f1b0
MD5 hash: 803313ee6e89eb27b5e3470379cf879c
humanhash: jig-white-bakerloo-lion
File name:0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Download: download sample
Signature Havoc
Create hunting rule
File size:373'760 bytes
First seen:2025-04-18 06:06:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f2d203ea73c5f636ca8e7ccce9ee0b32 (2 x Havoc)
ssdeep 6144:XR1TE2jrSewUZ4m46F9RIgVRUZP9EhNuz0u+/9sO1LztmGy3Bfy4KTGQhF:LTBRv5Z/VRUZ1EqcLRm93hy4KT9
Threatray 1 similar samples on MalwareBazaar
TLSH T1A28423D161131F19E162A4B246DED1F113F8AAD1187D3B840DEAA6633A3CAE1FD811CF
TrID 63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12)
24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.ICL) Windows Icons Library (generic) (2059/9)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter JAMESWT_WT
Tags:eclectic-twilight-7a616e-netlify-app exe Havoc

Intelligence

File Origin
# of uploads :
1
# of downloads :
440
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Verdict:
No threats detected
Analysis date:
2025-04-18 06:54:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/505bc2e8-bb15-43ee-aad3-29d5481eb7e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/2798/
Detection(s):
SecuriteInfo.com.FileRepMalware.28908.31005.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6801f1a0280f5f89a0d10c98
Tags:
virus spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a service
Loading a system driver
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm crypto crypto entropy microsoft_visual_cc nokoyawa packed packed packed packer_detected upx virtual
Link:
https://www.filescan.io/uploads/6801ec1490767142c3da46d0/reports/9a1038e5-2cbe-4e28-8436-8e76d5621f82/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f75c21e8-e40b-40a0-bd26-adb83e4b6473
Result
Threat name:
Havoc
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1668190
Signature
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Yara detected Havoc
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-18 06:03:32 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7h5bwlpnid2cahbrcnjcvnbmjijsxdchicnecrywvci4e2s2gwq._file
Verdict:
malicious
Label(s):
havoc
Create hunting rule
Similar samples:
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
Havoc
error
Havoc
Result
Malware family:
n/a
Score:
  6/10
Tags:
upx
Link:
https://tria.ge/reports/250418-gvettsvvfy/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
UPX packed file
Enumerates connected drives
Verdict:
Malicious
Tags:
red_team_tool havoc
YARA:
win_havoc_ntdll_hashes_oct_2022
Link:
https://app.threat.zone/submission/64d55f89-6ee1-4c96-add5-13b4206c74e6
Unpacked files
SH256 hash:
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
MD5 hash:
803313ee6e89eb27b5e3470379cf879c
SHA1 hash:
660c61332dd7d895bb1ef6ea15b0fe295280f1b0
Detections:
win_havoc_w0
Create hunting rule
Link:
https://www.unpac.me/results/17d41e0f-8252-4947-bc4e-74ac1b4d8d65/
SH256 hash:
3a478d39acab4fdbdacf7aaf1fe272b4f0e751b4880e9071117833ba743d086b
MD5 hash:
1c979af0b9db31a5e54efae4914dc83b
SHA1 hash:
0de8401addc0340f73910b0e89d687a5732f5898
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Link:
https://www.unpac.me/results/17d41e0f-8252-4947-bc4e-74ac1b4d8d65/
Parent samples :
335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
SH256 hash:
9427eb29587a51953aae971673555040309c33d68505f55d7e6188f4167503b9
MD5 hash:
5e9713bf300522fe0dda0479e922f20f
SHA1 hash:
fc0a15b13a8d234d470af2ad91b31827daa849f3
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Link:
https://www.unpac.me/results/17d41e0f-8252-4947-bc4e-74ac1b4d8d65/
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0fcfd0d96f6a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DemonNtdllHashes
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:RAN_Rook_Dec_2021_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect Rook ransomware
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:Windows_Trojan_Generic_9997489c
Create hunting rule
Author:Elastic Security
Rule name:win_havoc_demon_ntdll_hashes
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_w0
Create hunting rule
Author:embee_research @ HuntressLabs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/2798/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptDecrypt

Comments