MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Havoc


Vendor detections: 13


Intelligence 13 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a
SHA3-384 hash: 1787864d61eb1c5072515363be2798583f8bfbd4eea97ee0a6cf1c8cdc36fdfe0477e17b0cc0e60cf6dd66ff5c3c0ffb
SHA1 hash: 44244c1ecb254c6fa62675ec017f99accf6bc298
MD5 hash: 743b40aeaa37ba28faa37dd2bb95d8e7
humanhash: one-ack-sad-arizona
File name:SecuriteInfo.com.Win32.Agent-BENY.64284147
Download: download sample
Signature Havoc
Create hunting rule
File size:215'861 bytes
First seen:2025-11-29 06:36:38 UTC
Last seen:2025-11-29 07:23:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4834d1a001382ca4989bc22fa8cfc5fa (1 x Havoc)
ssdeep 3072:gp0V/D2dwv4iZxmvuXMf9g+8O1UR0VuteWWR94Im:guadwvhxmv3lHAlIm
Threatray 2 similar samples on MalwareBazaar
TLSH T147243A83A5D698FBC56DC13886EB8336AB76B5CC165167071B20D6311F23AF07F5B20A
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe Havoc

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.Agent-BENY.64284147
Verdict:
No threats detected
Analysis date:
2025-11-29 06:40:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b02ebdb8-5667-4162-ae0f-e2ded848be1f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41803/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692a94aa6cb1dcd57782478a
Tags:
injection obfusc
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Launching the default Windows debugger (dwwin.exe)
DNS request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug overlay overlay packed
Link:
https://www.filescan.io/uploads/692a94a7efb205635358db54/reports/0efe3330-11ee-4ba7-823f-4b980b10c10b/overview
Verdict:
Malicious
Labled as:
Trojan.Havokiz.Marte.E.Generic
Link:
https://www.hybrid-analysis.com/sample/e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a
Result
Gathering data
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-29T03:03:00Z UTC
Last seen:
2025-11-29T03:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a/results?tab=lookup
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eacf1b97-ac3a-457d-a71b-d87e9c858b41
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/743b40aeaa37ba28faa37dd2bb95d8e7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a/
Threat name:
Win64.Trojan.HavokizMarte
Create hunting rule
Status:
Malicious
First seen:
2025-11-29 05:19:42 UTC
File Type:
PE+ (Exe)
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4bkb77qzyo5jc3nun3gvbfvsb3nvbzzq6kk6azpluavdtxuxknfa._file
Verdict:
malicious
Label(s):
havoc
Create hunting rule
Similar samples:
7bd0979b956900df4b7bb438caf3b3c64257d470f1ab93df680ab0de58ead80f
Havoc
error
Havoc
Result
Malware family:
havoc
Create hunting rule
Score:
  10/10
Tags:
family:havoc backdoor
Link:
https://tria.ge/reports/251129-hdnaba1nf1/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Detects Havoc payload
Havoc family
Havoc, HavocC2
Unpacked files
SH256 hash:
e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a
MD5 hash:
743b40aeaa37ba28faa37dd2bb95d8e7
SHA1 hash:
44244c1ecb254c6fa62675ec017f99accf6bc298
Detections:
win_havoc_w0
Create hunting rule
win_havoc_w1
Create hunting rule
Link:
https://www.unpac.me/results/1735691b-e5be-4c13-968e-6976bef7f777/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DemonNtdllHashes
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HavocDemonDJB2
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:mal_loader_havoc_x64
Create hunting rule
Author:Maxime THIEBAUT (@0xThiebaut)
Description:Detects Havoc C2's import hashing algorithm
Reference:https://github.com/HavocFramework/Havoc/blob/1248ff9ecc964325447128ae3ea819f1ad10b790/Teamserver/data/implants/Shellcode/Source/Utils.c
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Generic_Threat_3f390999
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Generic_9997489c
Create hunting rule
Author:Elastic Security
Rule name:win_havoc_demon_ntdll_hashes
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_djb2_hashing_routine_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:win_havoc_ntdll_hashes_oct_2022
Create hunting rule
Author:embee_research @ HuntressLabs
Description:Detection of havoc demons via hardcoded ntdll api hashes
Rule name:win_havoc_w0
Create hunting rule
Author:embee_research @ HuntressLabs
Rule name:win_havoc_w1
Create hunting rule
Author:embee_research @ HuntressLabs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Havoc

Executable exe e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3719379/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/41803/

Comments