Havex RAT (Malware Family)

Havex RAT

VTCollection

Havex is a remote access trojan (RAT) that was discovered in 2013 as part of a widespread espionage campaign targeting industrial control systems (ICS) used across numerous industries and attributed to a hacking group referred to as "Dragonfly" and "Energetic Bear". Havex is estimated to have impacted thousands of infrastructure sites, a majority of which were located in Europe and the United States. Within the energy sector, Havex specifically targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and industrial equipment providers. Havex also impacted organizations in the aviation, defense, pharmaceutical, and petrochemical industries.

Once installed, Havex scanned the infected system to locate any Supervisory Control and Data Acquisition (SCADA) or ICS devices on the network and sent the data back to command and control servers. To do so, the malware leveraged the Open Platform Communications (OPC) standard, which is a universal communication protocol used by ICS components across many industries that facilitates open connectivity and vendor equipment interoperability. Havex used the Distributed Component Object Model (DCOM) to connect to OPC servers inside of an ICS network and collect information such as CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth.

Havex was an intelligence-collection tool used for espionage and not for the disruption or destruction of industrial systems. However, the data collected by Havex would have aided efforts to design and develop attacks against specific targets or industries.

References

2022-03-24 ⋅ CISA ⋅ US-CERT
Alert (AA22-083A) Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector
Havex RAT Triton

2021-06-24 ⋅ Gigamon ⋅ Joe Slowik
The Baffling Berserk Bear: A Decade's Activity targeting Critical Infrastructure
Havex RAT Heriplor Karagany

2020-12-21 ⋅ IronNet ⋅ Adam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess

2020-11-04 ⋅ Stranded on Pylos Blog ⋅ Joe Slowik
The Enigmatic Energetic Bear
EternalPetya Havex RAT

2020-01-01 ⋅ SecurityWeek ⋅ SecureWorks
IRON LIBERTY
Havex RAT Karagany

2014-06-23 ⋅ F-Secure ⋅ Daavid
Havex Hunts For ICS/SCADA Systems
Havex RAT

Yara Rules

[TLP:WHITE] win_havex_rat_auto (20260917 | Detects win.havex_rat.)

rule win_havex_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.havex_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { a3???????? c705????????402e0310 c705????????21250310 c705????????83240310 c705????????10240310 c3 8bff }
            // n = 7, score = 100
            //   a3????????           |                     
            //   c705????????402e0310     |     
            //   c705????????21250310     |     
            //   c705????????83240310     |     
            //   c705????????10240310     |     
            //   c3                   | ret                 
            //   8bff                 | mov                 edi, edi

        $sequence_1 = { 7c04 3bf9 7306 f7df 13f1 f7de 51 }
            // n = 7, score = 100
            //   7c04                 | jl                  6
            //   3bf9                 | cmp                 edi, ecx
            //   7306                 | jae                 8
            //   f7df                 | neg                 edi
            //   13f1                 | adc                 esi, ecx
            //   f7de                 | neg                 esi
            //   51                   | push                ecx

        $sequence_2 = { 68???????? 8d4dd8 e8???????? 2175fc 8d45d8 50 6a01 }
            // n = 7, score = 100
            //   68????????           |                     
            //   8d4dd8               | lea                 ecx, [ebp - 0x28]
            //   e8????????           |                     
            //   2175fc               | and                 dword ptr [ebp - 4], esi
            //   8d45d8               | lea                 eax, [ebp - 0x28]
            //   50                   | push                eax
            //   6a01                 | push                1

        $sequence_3 = { 85c0 7404 8b08 eb02 33c9 8b491c }
            // n = 6, score = 100
            //   85c0                 | test                eax, eax
            //   7404                 | je                  6
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   eb02                 | jmp                 4
            //   33c9                 | xor                 ecx, ecx
            //   8b491c               | mov                 ecx, dword ptr [ecx + 0x1c]

        $sequence_4 = { e8???????? e8???????? c21000 55 8bec 83e4f8 6aff }
            // n = 7, score = 100
            //   e8????????           |                     
            //   e8????????           |                     
            //   c21000               | ret                 0x10
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83e4f8               | and                 esp, 0xfffffff8
            //   6aff                 | push                -1

        $sequence_5 = { e8???????? 83672000 6a00 6a01 8d4dd8 c645fc06 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83672000             | and                 dword ptr [edi + 0x20], 0
            //   6a00                 | push                0
            //   6a01                 | push                1
            //   8d4dd8               | lea                 ecx, [ebp - 0x28]
            //   c645fc06             | mov                 byte ptr [ebp - 4], 6
            //   e8????????           |                     

        $sequence_6 = { 33c0 8b00 8b4d2c 8b7524 8945f0 8b4520 8945f8 }
            // n = 7, score = 100
            //   33c0                 | xor                 eax, eax
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   8b4d2c               | mov                 ecx, dword ptr [ebp + 0x2c]
            //   8b7524               | mov                 esi, dword ptr [ebp + 0x24]
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   8b4520               | mov                 eax, dword ptr [ebp + 0x20]
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

        $sequence_7 = { ebd0 8bc8 c1f905 8d3c8d60480610 8bf0 83e61f c1e606 }
            // n = 7, score = 100
            //   ebd0                 | jmp                 0xffffffd2
            //   8bc8                 | mov                 ecx, eax
            //   c1f905               | sar                 ecx, 5
            //   8d3c8d60480610       | lea                 edi, [ecx*4 + 0x10064860]
            //   8bf0                 | mov                 esi, eax
            //   83e61f               | and                 esi, 0x1f
            //   c1e606               | shl                 esi, 6

        $sequence_8 = { d1f8 8d3c08 8b06 8b0e c1f80c 3207 c1f90c }
            // n = 7, score = 100
            //   d1f8                 | sar                 eax, 1
            //   8d3c08               | lea                 edi, [eax + ecx]
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8b0e                 | mov                 ecx, dword ptr [esi]
            //   c1f80c               | sar                 eax, 0xc
            //   3207                 | xor                 al, byte ptr [edi]
            //   c1f90c               | sar                 ecx, 0xc

        $sequence_9 = { 8b557c 4a 3bfa 894568 7e13 }
            // n = 5, score = 100
            //   8b557c               | mov                 edx, dword ptr [ebp + 0x7c]
            //   4a                   | dec                 edx
            //   3bfa                 | cmp                 edi, edx
            //   894568               | mov                 dword ptr [ebp + 0x68], eax
            //   7e13                 | jle                 0x15

    condition:
        7 of them and filesize < 892928
}

Download all Yara Rules

Havex RAT Propose Change

References

Yara Rules

Havex RAT