Havoc (Malware Family)

Havoc

aka: Havokiz

VTCollection

First released in October 2022, the Havoc C2 Framework is a flexible post-exploitation framework written in Golang, C++, and Qt, with agents called 'Demons' written in C and ASM, created by @C5pider. Designed to support red team engagements and adversary emulation, it offers a robust set of capabilities tailored for offensive security operations. The framework, which is under active development, utilizes HTTP(s) and SMB as communication protocols for its implants. Havoc can generate implants, known as Demons, in several formats including EXE, DLL, and Shellcode. A notable feature of Havoc is its ability to bypass EDR by employing advanced evasion techniques such as sleep obfuscation, return address stack spoofing, and indirect syscalls. This capability enhances its effectiveness in evading detection and circumventing security measures.

References

2023-10-10 ⋅ Symantec ⋅ Threat Hunter Team
Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan
Cobalt Strike Havoc MimiKatz Grayling

Yara Rules

[TLP:WHITE] win_havoc_auto (20241030 | Detects win.havoc.)

rule win_havoc_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.havoc."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 85c0 7856 488b842488000000 488bb42488000000 4531c9 }
            // n = 5, score = 800
            //   85c0                 | dec                 eax
            //   7856                 | mov                 dword ptr [esp + 0x28], eax
            //   488b842488000000     | test                eax, eax
            //   488bb42488000000     | dec                 eax
            //   4531c9               | mov                 eax, dword ptr [ebx]

        $sequence_1 = { 31c0 80bc245e01000001 0f95c0 83c008 }
            // n = 4, score = 800
            //   31c0                 | movzx               edx, byte ptr [ecx + 0x1e]
            //   80bc245e01000001     | movzx               eax, byte ptr [ecx + 0x1f]
            //   0f95c0               | and                 esi, 7
            //   83c008               | jne                 0xa3

        $sequence_2 = { 49c1e504 4c01e9 4c8b01 4d85c0 }
            // n = 4, score = 800
            //   49c1e504             | dec                 eax
            //   4c01e9               | mov                 eax, dword ptr [edi]
            //   4c8b01               | inc                 esp
            //   4d85c0               | mov                 eax, dword ptr [esp + 0x3c]

        $sequence_3 = { 89f8 5b 5e 5f 5d 415c }
            // n = 6, score = 800
            //   89f8                 | inc                 ecx
            //   5b                   | mov                 eax, 0x42
            //   5e                   | dec                 eax
            //   5f                   | mov                 ecx, ebp
            //   5d                   | call                dword ptr [eax + 0x164]
            //   415c                 | jmp                 0x1b0c

        $sequence_4 = { 4181c0ff0f0000 488b00 4181e000f0ffff 4889542420 4889ca 4883c9ff }
            // n = 6, score = 800
            //   4181c0ff0f0000       | mov                 eax, dword ptr [eax]
            //   488b00               | dec                 eax
            //   4181e000f0ffff       | mov                 ecx, dword ptr [ebx + 0x18]
            //   4889542420           | dec                 eax
            //   4889ca               | test                ecx, ecx
            //   4883c9ff             | je                  0x15f9

        $sequence_5 = { 6bc018 44898424c4000000 48c78424c800000001001800 f3a5 83c01f }
            // n = 5, score = 800
            //   6bc018               | mov                 ecx, 1
            //   44898424c4000000     | dec                 eax
            //   48c78424c800000001001800     | mov    dword ptr [esp + 0x30], edx
            //   f3a5                 | dec                 eax
            //   83c01f               | lea                 edx, [esp + 0x30]

        $sequence_6 = { 85f6 0f95c0 4883c9ff 01c0 8944244c }
            // n = 5, score = 800
            //   85f6                 | mov                 dword ptr [esp + 0x48], eax
            //   0f95c0               | dec                 eax
            //   4883c9ff             | arpl                word ptr [ecx + 0x3c], ax
            //   01c0                 | dec                 eax
            //   8944244c             | add                 eax, ecx

        $sequence_7 = { 4d8b0c3a 48c1e204 4b8d0c01 8b01 49034412f0 4b8d540104 }
            // n = 6, score = 800
            //   4d8b0c3a             | mov                 dword ptr [edx + 0x41c], eax
            //   48c1e204             | dec                 eax
            //   4b8d0c01             | mov                 ecx, dword ptr [edx + 0x634]
            //   8b01                 | mov                 edx, 0xce4cd9cb
            //   49034412f0           | dec                 eax
            //   4b8d540104           | mov                 edx, dword ptr [ebx]

        $sequence_8 = { 4531c0 31d2 e8???????? 4883c428 }
            // n = 4, score = 800
            //   4531c0               | inc                 ecx
            //   31d2                 | mov                 eax, dword ptr [esp]
            //   e8????????           |                     
            //   4883c428             | test                eax, eax

        $sequence_9 = { 85c0 7856 488b842488000000 488bb42488000000 4531c9 4531c0 488b8c24a0000000 }
            // n = 7, score = 800
            //   85c0                 | dec                 eax
            //   7856                 | or                  ecx, 0xffffffff
            //   488b842488000000     | dec                 eax
            //   488bb42488000000     | mov                 dword ptr [esp + 0x20], 0
            //   4531c9               | inc                 ecx
            //   4531c0               | mov                 ecx, 0x38
            //   488b8c24a0000000     | call                dword ptr [eax + 0x5c4]

    condition:
        7 of them and filesize < 164864
}

[TLP:WHITE] win_havoc_w0 (20221012 | No description)

rule win_havoc_w0 {
	//Detects ntdll API hashes used in Havoc C2 Demon payloads
    
	meta:
		author = "embee_research @ HuntressLabs"
		vendor = "Huntress Research" 
		date = "2022/10/11"
		source = "https://raw.githubusercontent.com/embee-research/Yara/main/HavocDemons.yara"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
        malpedia_rule_date = "20221012"
        malpedia_hash = ""
        malpedia_version = "20221012"
        malpedia_sharing = "TLP:WHITE"
	strings:
		
		// Syscall Hashes
		$nt_hash1 = {53 17 e6 70} //0x70e61753 == ntdll.dll
		$nt_hash2 = {43 6a 45 9e} //0x9e456a43 == LdrLoadDll
		$nt_hash3 = {ec b8 83 f7} //0xf783b8ec == NtAllocateVirtualMemory
		$nt_hash4 = {88 28 e9 50} //0x50e92888 == NtProtectVirtualMemory
        
        
		$nt_hash5 = {f6 99 5a 2e} //0x2e5a99f6 == LdrGetProcedureAddress
		$nt_hash6 = {da 81 b3 c0} //0xc0b381da == NtAllocateHeap
		$nt_hash7 = {d7 71 ba 70} //0x70ba71d7 == RtlFreeHeap
		$nt_hash8 = {88 2b 49 8e} //0x8e492b88 == RtlExitUserThread
		$nt_hash9 = {ef f0 a1 3a} //0x3aa1f0ef == RtlExitUserProcess
		$nt_hash10 = {f5 39 34 7c} //0x7c3439f5 == RtlRandomEx
		$nt_hash11 = {70 f2 ab 35} //0x35abf270 == RtlNtStatusToDosError
		$nt_hash12 = {1d aa a3 3c} //0x3ca3aa1d == RtlGetVersion
		$nt_hash13 = {11 b2 8f f7} //0xf78fb211 == RtlCreateTimerQueue
		$nt_hash14 = {4c 7c de a5} //0xa5de7c4c == RtlCreateTimer
		$nt_hash15 = {90 fe 61 95} //0x9561fe90 == RtlDeleteTimerQueue
		$nt_hash16 = {d0 ee 33 77} //0x7733eed0 == RtlCaptureContext
		$nt_hash17 = {a9 af 4b 55} //0x554bafa9 == RtlAddVectoredExceptionHandler
		$nt_hash18 = {0e 21 0c 88} //0x880c210e == RtlRemoveVectoredExceptionHandler
		$nt_hash19 = {3d 13 8e 8b} //0x8b8e133d == NtClose
		$nt_hash20 = {7d 74 58 ca} //0xca58747d == ZwCreateEvent
		
	condition:
		//PE or Shellcode or Shellcode
		//Leave as "3 of them" for more robust (but compute expensive) searching
		(3 of them) and (uint16(0) == 0x5a4d or uint16(0) == 0x00e8 or uint16(0) == 0x4856)
}

[TLP:WHITE] win_havoc_w1 (20221012 | No description)

rule win_havoc_w1 {
	//Detects the hashing routine used in Havoc C2
    
	meta:
		author = "embee_research @ HuntressLabs"
		vendor = "Huntress Research" 
		date = "2022/10/11"
		source = "https://raw.githubusercontent.com/embee-research/Yara/main/HavocDemonDJB2.yara"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
        malpedia_rule_date = "20221012"
        malpedia_hash = ""
        malpedia_version = "20221012"
        malpedia_sharing = "TLP:WHITE"
	strings:
		

		//  Hashing Routine of DLL   
		$dll = {b8 05 15 00 00 0f be 11 48 ff c1 84 d2 74 07 6b c0 21 01 d0 eb ef} 
		
		                             
        //Hashing Routine of Shellcode
		$shellcode = {41 80 f8 60 76 04 41 83 e8 20 6b c0 21 45 0f b6 c0 49 ff c1 44 01 c0 eb c4}
		
		
	condition:
		//PE or Shellcode or Shellcode
		//Leave as "any of them" for more robust (but compute expensive) searching
		(any of them) and (uint16(0) == 0x5a4d or uint16(0) == 0x00e8 or uint16(0) == 0x4856)
}

Download all Yara Rules

Havoc Propose Change

References

Yara Rules

Havoc