MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Havoc


Vendor detections: 15


Intelligence 15 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
SHA3-384 hash: d07d126bfa5c7fce07412b35883685c6a9eaa60c97715f5e47600b1b615fca60fe297992b8d23868f757dc719369ce79
SHA1 hash: b9c2bb248ba218212af00c925c7ef8ff88fecad9
MD5 hash: 3c1d139630b6de04c3b703778e8ce5ab
humanhash: florida-london-floor-high
File name:ktool.exe
Download: download sample
Signature Havoc
Create hunting rule
File size:558'080 bytes
First seen:2025-04-04 10:13:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 981333570815d617f83d032790a3e496 (2 x Havoc)
ssdeep 12288:vfKBQpu7kYeXnJpUMCVYJMHZWz2vleai4jcIls/LXBaCZ:vPXnJHSWKvK4Fsw
TLSH T1B1C4AF43B6A620FAD0F6C13946961236FAF2706903246B9F0750C7326F276E46E3F756
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:exe Havoc hilarious-trifle-d9182e-netlify-app

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'554
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/582/
Detection(s):
Win.Trojan.Havoc-10035024-0
Create hunting rule

Win.Malware.Marte-10032613-0
Create hunting rule

Win.Trojan.Havoc-10034344-0
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67efb2c7855e5ec5240df083
Tags:
ransomware shellcode dropper
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a service
Loading a system driver
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm crypto havoc microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/67efb0bb40adfb5162b8fc09/reports/efb9c83b-6ff6-417a-931e-4d3a330580cb/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70208d15-9cba-4458-9123-7084d5c23c33
Result
Threat name:
Havoc
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1656546
Signature
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Yara detected Havoc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1656546 Sample: ktool.exe Startdate: 04/04/2025 Architecture: WINDOWS Score: 68 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected Havoc 2->16 6 ktool.exe 2 2->6         started        process3 file4 12 C:\Users\user\AppData\Local\...\iqvw64e.sys, PE32+ 6->12 dropped 18 Sample is not signed and drops a device driver 6->18 10 conhost.exe 6->10         started        signatures5 process6
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-03-31 15:41:45 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnkbdsb6cqm4pkihjqp6a52sitqcbthlvv3fqlisrgfd7dbhpcqa._file
Verdict:
malicious
Label(s):
havoc
Create hunting rule
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/250404-l8822svsay/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Enumerates connected drives
Verdict:
Malicious
Tags:
red_team_tool havoc Win.Trojan.Havoc-10035024-0
YARA:
win_havoc_djb2_hashing_routine_oct_2022 win_havoc_ntdll_hashes_oct_2022 Windows_Trojan_Havoc_9c7bb863
Link:
https://app.threat.zone/submission/32d1d48c-fd06-44a3-ad7e-a01afb7276d6
Unpacked files
SH256 hash:
335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
MD5 hash:
3c1d139630b6de04c3b703778e8ce5ab
SHA1 hash:
b9c2bb248ba218212af00c925c7ef8ff88fecad9
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
Link:
https://www.unpac.me/results/8edefcdb-daf0-4e0f-a36f-1f41d8c73c4a/
SH256 hash:
3a478d39acab4fdbdacf7aaf1fe272b4f0e751b4880e9071117833ba743d086b
MD5 hash:
1c979af0b9db31a5e54efae4914dc83b
SHA1 hash:
0de8401addc0340f73910b0e89d687a5732f5898
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Link:
https://www.unpac.me/results/8edefcdb-daf0-4e0f-a36f-1f41d8c73c4a/
Parent samples :
335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0
330e415ed1dd462486bd99676ef03bcc1da05c17ced655f82b2fbd0787e7dc8f
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/335411c83e14/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/335411c83e1419c7a9074c1fe0775244e020ccebad76582d12898a3f8c2778a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DemonNtdllHashes
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HavocDemonDJB2
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:mal_loader_havoc_x64
Create hunting rule
Author:Maxime THIEBAUT (@0xThiebaut)
Description:Detects Havoc C2's import hashing algorithm
Reference:https://github.com/HavocFramework/Havoc/blob/1248ff9ecc964325447128ae3ea819f1ad10b790/Teamserver/data/implants/Shellcode/Source/Utils.c
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Generic_9997489c
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Havoc_9c7bb863
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Havoc_ffecc8af
Create hunting rule
Author:Elastic Security
Rule name:win_havoc_demon_ntdll_hashes
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_w0
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:win_havoc_w1
Create hunting rule
Author:embee_research @ HuntressLabs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/582/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
KERNEL_APIManipulates Windows Kernel & Driversntdll.dll::RtlInitUnicodeString
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
ntdll.dll::NtQuerySystemInformation
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileA
KERNEL32.dll::GetSystemDirectoryA
KERNEL32.dll::GetFileAttributesA
KERNEL32.dll::GetTempPathA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextW
ADVAPI32.dll::CryptCreateHash
ADVAPI32.dll::CryptDecrypt
ADVAPI32.dll::CryptDeriveKey
ADVAPI32.dll::CryptHashData
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::CreateServiceA
ADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceA

Comments