Havex RAT (Malware Family)

Havex RAT

Havex is a remote access trojan (RAT) that was discovered in 2013 as part of a widespread espionage campaign targeting industrial control systems (ICS) used across numerous industries and attributed to a hacking group referred to as "Dragonfly" and "Energetic Bear". Havex is estimated to have impacted thousands of infrastructure sites, a majority of which were located in Europe and the United States. Within the energy sector, Havex specifically targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and industrial equipment providers. Havex also impacted organizations in the aviation, defense, pharmaceutical, and petrochemical industries.

Once installed, Havex scanned the infected system to locate any Supervisory Control and Data Acquisition (SCADA) or ICS devices on the network and sent the data back to command and control servers. To do so, the malware leveraged the Open Platform Communications (OPC) standard, which is a universal communication protocol used by ICS components across many industries that facilitates open connectivity and vendor equipment interoperability. Havex used the Distributed Component Object Model (DCOM) to connect to OPC servers inside of an ICS network and collect information such as CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth.

Havex was an intelligence-collection tool used for espionage and not for the disruption or destruction of industrial systems. However, the data collected by Havex would have aided efforts to design and develop attacks against specific targets or industries.

References

2022-03-24 ⋅ CISA ⋅ US-CERT
Alert (AA22-083A) Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector
Havex RAT Triton

2021-06-24 ⋅ Gigamon ⋅ Joe Slowik
The Baffling Berserk Bear: A Decade's Activity targeting Critical Infrastructure
Havex RAT Heriplor Karagany

2020-12-21 ⋅ IronNet ⋅ Adam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess

2020-11-04 ⋅ Stranded on Pylos Blog ⋅ Joe Slowik
The Enigmatic Energetic Bear
EternalPetya Havex RAT

2020 ⋅ SecurityWeek ⋅ SecureWorks
IRON LIBERTY
Havex RAT Karagany

2014-06-23 ⋅ F-Secure ⋅ Daavid
Havex Hunts For ICS/SCADA Systems
Havex RAT

Yara Rules

[TLP:WHITE] win_havex_rat_auto (20230715 | Detects win.havex_rat.)

rule win_havex_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.havex_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c706???????? e8???????? c3 56 8bf1 c706???????? e8???????? }
            // n = 7, score = 100
            //   c706????????         |                     
            //   e8????????           |                     
            //   c3                   | ret                 
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   c706????????         |                     
            //   e8????????           |                     

        $sequence_1 = { 0fb700 6683f82f 740a 6683f85c 0f85b9000000 837e1401 }
            // n = 6, score = 100
            //   0fb700               | movzx               eax, word ptr [eax]
            //   6683f82f             | cmp                 ax, 0x2f
            //   740a                 | je                  0xc
            //   6683f85c             | cmp                 ax, 0x5c
            //   0f85b9000000         | jne                 0xbf
            //   837e1401             | cmp                 dword ptr [esi + 0x14], 1

        $sequence_2 = { 03d8 8d7de8 e8???????? 8b5e18 8d7de0 e8???????? 8b5d08 }
            // n = 7, score = 100
            //   03d8                 | add                 ebx, eax
            //   8d7de8               | lea                 edi, [ebp - 0x18]
            //   e8????????           |                     
            //   8b5e18               | mov                 ebx, dword ptr [esi + 0x18]
            //   8d7de0               | lea                 edi, [ebp - 0x20]
            //   e8????????           |                     
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]

        $sequence_3 = { 68???????? 8d8d2cfdffff 89bd4cfdffff 89b560fdffff e8???????? 8d45b4 50 }
            // n = 7, score = 100
            //   68????????           |                     
            //   8d8d2cfdffff         | lea                 ecx, [ebp - 0x2d4]
            //   89bd4cfdffff         | mov                 dword ptr [ebp - 0x2b4], edi
            //   89b560fdffff         | mov                 dword ptr [ebp - 0x2a0], esi
            //   e8????????           |                     
            //   8d45b4               | lea                 eax, [ebp - 0x4c]
            //   50                   | push                eax

        $sequence_4 = { ff00 eb1f 3b45d4 7f1a 83c12c 69c902010000 }
            // n = 6, score = 100
            //   ff00                 | inc                 dword ptr [eax]
            //   eb1f                 | jmp                 0x21
            //   3b45d4               | cmp                 eax, dword ptr [ebp - 0x2c]
            //   7f1a                 | jg                  0x1c
            //   83c12c               | add                 ecx, 0x2c
            //   69c902010000         | imul                ecx, ecx, 0x102

        $sequence_5 = { 0f8f11020000 8a463c 8b4e38 884608 8b4624 69c0a0860100 c7460c01000000 }
            // n = 7, score = 100
            //   0f8f11020000         | jg                  0x217
            //   8a463c               | mov                 al, byte ptr [esi + 0x3c]
            //   8b4e38               | mov                 ecx, dword ptr [esi + 0x38]
            //   884608               | mov                 byte ptr [esi + 8], al
            //   8b4624               | mov                 eax, dword ptr [esi + 0x24]
            //   69c0a0860100         | imul                eax, eax, 0x186a0
            //   c7460c01000000       | mov                 dword ptr [esi + 0xc], 1

        $sequence_6 = { 8b00 eb02 33c0 8b00 8b4d2c 8b7524 }
            // n = 6, score = 100
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   8b4d2c               | mov                 ecx, dword ptr [ebp + 0x2c]
            //   8b7524               | mov                 esi, dword ptr [ebp + 0x24]

        $sequence_7 = { 8b4de0 8b0c81 8bc6 e8???????? 8b45dc 0fb7444334 0fb60c07 }
            // n = 7, score = 100
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   8b0c81               | mov                 ecx, dword ptr [ecx + eax*4]
            //   8bc6                 | mov                 eax, esi
            //   e8????????           |                     
            //   8b45dc               | mov                 eax, dword ptr [ebp - 0x24]
            //   0fb7444334           | movzx               eax, word ptr [ebx + eax*2 + 0x34]
            //   0fb60c07             | movzx               ecx, byte ptr [edi + eax]

        $sequence_8 = { 03048d60480610 eb02 8bc2 f6402480 741f e8???????? 33ff }
            // n = 7, score = 100
            //   03048d60480610       | add                 eax, dword ptr [ecx*4 + 0x10064860]
            //   eb02                 | jmp                 4
            //   8bc2                 | mov                 eax, edx
            //   f6402480             | test                byte ptr [eax + 0x24], 0x80
            //   741f                 | je                  0x21
            //   e8????????           |                     
            //   33ff                 | xor                 edi, edi

        $sequence_9 = { 59 33f6 33ff 56 }
            // n = 4, score = 100
            //   59                   | pop                 ecx
            //   33f6                 | xor                 esi, esi
            //   33ff                 | xor                 edi, edi
            //   56                   | push                esi

    condition:
        7 of them and filesize < 892928
}

Download all Yara Rules

Havex RAT Propose Change

References

Yara Rules

Havex RAT