MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Havoc


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
SHA3-384 hash: 7f32d5e7b30e7381ec89f184e87de1fa2060f31e89e483e8da3caf01c8f70970b8dfe968e0fefcac3e9026ba0f80c1e2
SHA1 hash: 21a5325e76b12971ceb19b5d9f82462f34cebfca
MD5 hash: 8861637c234dcc9e6929e527fb526a5d
humanhash: carolina-missouri-summer-ohio
File name:1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
Download: download sample
Signature Havoc
Create hunting rule
File size:373'760 bytes
First seen:2025-04-18 06:06:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f2d203ea73c5f636ca8e7ccce9ee0b32 (2 x Havoc)
ssdeep 6144:lyVdj3QQVZne8oTIPNXpY61TEzq+dlzxHcFP1zAPdlXhlsjAmdV+JC0Blzw:ly8QfRHPJa6+q+PNcFoxcAWVaC0n
Threatray 1 similar samples on MalwareBazaar
TLSH T14F8423C8B4122D8CF4DA99722A41E6F76692B07DC9383FBD0E198F3521746D3CE4A847
TrID 63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12)
24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.ICL) Windows Icons Library (generic) (2059/9)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter JAMESWT_WT
Tags:eclectic-twilight-7a616e-netlify-app exe Havoc

Intelligence

File Origin
# of uploads :
1
# of downloads :
405
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
Verdict:
No threats detected
Analysis date:
2025-04-18 06:40:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6ed86a49-9221-4549-a8bd-5cb7370e32f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/2796/
Detection(s):
SecuriteInfo.com.FileRepMalware.13177.22993.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6801f19a280f5f89a0d10c6b
Tags:
ransomware cobalt virus spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a service
Loading a system driver
Searching for the window
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm crypto crypto entropy microsoft_visual_cc nokoyawa packed packed packed packer_detected upx virtual
Link:
https://www.filescan.io/uploads/6801ebda89fec6b88b9eee3b/reports/2d31a3d9-1857-4758-a63f-d428fb5f1212/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c251337e-5c79-4210-86c6-0becf44fb593
Result
Threat name:
Havoc
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1668182
Signature
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Yara detected Havoc
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-17 21:21:36 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dsil6ytzoqye3l7t5tbuggvwclrjlitxlncf4noyqwwkyterqwtq._file
Verdict:
malicious
Label(s):
havoc
Create hunting rule
Similar samples:
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Havoc
error
Havoc
Result
Malware family:
n/a
Score:
  6/10
Tags:
upx
Link:
https://tria.ge/reports/250418-gttxcswrz8/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
UPX packed file
Enumerates connected drives
Verdict:
Malicious
Tags:
red_team_tool havoc
YARA:
win_havoc_ntdll_hashes_oct_2022
Link:
https://app.threat.zone/submission/b4b0dc98-384b-418a-a63a-996c66522278
Unpacked files
SH256 hash:
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
MD5 hash:
8861637c234dcc9e6929e527fb526a5d
SHA1 hash:
21a5325e76b12971ceb19b5d9f82462f34cebfca
Detections:
win_havoc_w0
Create hunting rule
Link:
https://www.unpac.me/results/b7cac05b-224b-4c78-bb08-285d1b1fd5ef/
SH256 hash:
3a478d39acab4fdbdacf7aaf1fe272b4f0e751b4880e9071117833ba743d086b
MD5 hash:
1c979af0b9db31a5e54efae4914dc83b
SHA1 hash:
0de8401addc0340f73910b0e89d687a5732f5898
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Link:
https://www.unpac.me/results/b7cac05b-224b-4c78-bb08-285d1b1fd5ef/
Parent samples :
335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
SH256 hash:
b60fcf01ece26482c3455eb3d8f8e1d23e84f9d91651db3c78649301b1e47154
MD5 hash:
8b21ca3876d6f6da5cf6a504b9d8aed5
SHA1 hash:
6d49604080a65304130080f04824b9cd114d12a9
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Link:
https://www.unpac.me/results/b7cac05b-224b-4c78-bb08-285d1b1fd5ef/
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c90bf627974/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DemonNtdllHashes
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:RAN_Rook_Dec_2021_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect Rook ransomware
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:Windows_Trojan_Generic_9997489c
Create hunting rule
Author:Elastic Security
Rule name:win_havoc_demon_ntdll_hashes
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_w0
Create hunting rule
Author:embee_research @ HuntressLabs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/2796/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptDecrypt

Comments