MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Havoc


Vendor detections: 14


Intelligence 14 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
SHA3-384 hash: 94b620b66ec65d4be63adaf5587c194ca4f94a775ef76135ab504020dd35f7aa52932dc1ab5dcdb760eb71f06bdfe056
SHA1 hash: a4bed141811f8ffba453059677c135fdd889a878
MD5 hash: e3372fd5c6ab8f80b99a5cb03e4598c5
humanhash: four-paris-fifteen-mississippi
File name:330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
Download: download sample
Signature Havoc
Create hunting rule
File size:559'104 bytes
First seen:2025-04-04 10:21:27 UTC
Last seen:2025-04-04 10:21:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 981333570815d617f83d032790a3e496 (2 x Havoc)
ssdeep 12288:808g8tqpsD+rUpjyGJMHZWz2vleai4jcIls/LXBaC:nOkUp2WKvK4Fsw
TLSH T143C4CF1372A610FAD0F6C17946564232FBF7B0691324669F0760CB71AF27AE46A3F346
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:exe Havoc hilarious-trifle-d9182e-netlify-app

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'098
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/583/
Detection(s):
Win.Trojan.Havoc-10035024-0
Create hunting rule

Win.Malware.Marte-10032613-0
Create hunting rule

Win.Trojan.Havoc-10034344-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67efb3fe855e5ec5240df222
Tags:
ransomware dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a service
Loading a system driver
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm crypto havoc microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/67efb2df40adfb5162b8fe15/reports/5374c624-c84b-4e18-8ecc-d73b05adc97c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b0e6b3c-7b92-4bb4-a033-a2bf472b9224
Result
Threat name:
Havoc
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1656559
Signature
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Yara detected Havoc
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-03-25 07:34:39 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmhecxwr3vdcjbv5tftw54b3zqo2axaxz3lfl6blf66qpb7h3shq._file
Verdict:
malicious
Label(s):
havoc
Create hunting rule
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/250404-meef1svshs/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Enumerates connected drives
Verdict:
Malicious
Tags:
red_team_tool havoc Win.Trojan.Havoc-10035024-0
YARA:
win_havoc_djb2_hashing_routine_oct_2022 win_havoc_ntdll_hashes_oct_2022 Windows_Trojan_Havoc_9c7bb863
Link:
https://app.threat.zone/submission/46528b66-372a-4ccd-b50c-b88845e47488
Unpacked files
SH256 hash:
330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
MD5 hash:
e3372fd5c6ab8f80b99a5cb03e4598c5
SHA1 hash:
a4bed141811f8ffba453059677c135fdd889a878
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
Link:
https://www.unpac.me/results/cceb3d19-a9b3-4bcd-ab5a-4a3368250b66/
SH256 hash:
3a478d39acab4fdbdacf7aaf1fe272b4f0e751b4880e9071117833ba743d086b
MD5 hash:
1c979af0b9db31a5e54efae4914dc83b
SHA1 hash:
0de8401addc0340f73910b0e89d687a5732f5898
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Link:
https://www.unpac.me/results/cceb3d19-a9b3-4bcd-ab5a-4a3368250b66/
Parent samples :
335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DemonNtdllHashes
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HavocDemonDJB2
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:mal_loader_havoc_x64
Create hunting rule
Author:Maxime THIEBAUT (@0xThiebaut)
Description:Detects Havoc C2's import hashing algorithm
Reference:https://github.com/HavocFramework/Havoc/blob/1248ff9ecc964325447128ae3ea819f1ad10b790/Teamserver/data/implants/Shellcode/Source/Utils.c
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Generic_9997489c
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Havoc_9c7bb863
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Havoc_ffecc8af
Create hunting rule
Author:Elastic Security
Rule name:win_havoc_demon_ntdll_hashes
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_w0
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:win_havoc_w1
Create hunting rule
Author:embee_research @ HuntressLabs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/583/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
KERNEL_APIManipulates Windows Kernel & Driversntdll.dll::RtlInitUnicodeString
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
ntdll.dll::NtQuerySystemInformation
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileA
KERNEL32.dll::GetSystemDirectoryA
KERNEL32.dll::GetFileAttributesA
KERNEL32.dll::GetTempPathA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextW
ADVAPI32.dll::CryptCreateHash
ADVAPI32.dll::CryptDecrypt
ADVAPI32.dll::CryptDeriveKey
ADVAPI32.dll::CryptHashData
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::CreateServiceA
ADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceA

Comments