0191a561ee35d409097754fb8a250024a2e36622e3ef1c5684c9bd27471dc680

Sharing

Copy URL Twitter E-mail

General

Target
Havoc_C2.zip
Size 4.9MB
Sample260727-pkafcssala
SHA256 0191a561ee35d409097754fb8a250024a2e36622e3ef1c5684c9bd27471dc680
MD5 eb6f9dfa13f28318508259895cd35d41
SHA1 1f703e2887f574a1c1feb6797f4ef5a56e59318d
SHA512 2dc098efda754a746fa5ad936d32a3660ae4fd31d6cd7c47835d1d9fcc7184467862073b2064aea04ba1e003a0c3da35da64a82aaf0d5ea529cb0134fc5992ec
SSDEEP 98304:b3uL7oIdBdOBiQTZsTH2ur0geNoXRGpNWilyrTp7X1jgt8QROkbcb8+Xcf4WeIWo:b3uLcEvOBNZsq00gEzFlyH5Fj5SOQUl6
TLSH
T11B362309A9053C1ACC4412FA71893343AB1ED14A7B9F664F1A2A75797D8FC08EF5B39C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Havoc-main/client/CMakeLists.txt
- Size 6KB
- SHA256 5722d0fc7cda2fc03b8c8716162c37a78e761b0004ddef3381935d6cc22ae872
- MD5 8111993fc59d6e2ae014888b3fa6c452
- SHA1 d1293ba13a3e1a5d9bff177e718fde550e011321
- SHA512 7dbef670fd37b5c94756ab7489d858b62d78f772404e2344fd63d849acfdc951ccef2692d1e2916e5366f65fa065482bea00eccde628cc19bdc03316546c6ed5
- SSDEEP 96:ZsP46f0hk4jcP5hANF8KSIMR6M5LXWd745RwgpGeSu/yoBYeClm41zP/Vrf:aRf0hjbIE7cGefyoGeClm49P/Vb
- TLSH
  T1C8D13143453D60131EAE8AEB39465B2014D636A7B74104CE3A7CD98A8F4DDED7A533BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Havoc-main/client/include/Havoc/CmdLine.hpp
- Size 23KB
- SHA256 0da34fcd1cee908a2813d89dcd84093a3c04c0de2c8f39296967edc18697a9dd
- MD5 f712076a219283ef39b0f63f1d5d499a
- SHA1 8aced161809462ff75a7c513edb874e3f81f7fc0
- SHA512 8c7792c12fa82af83b972390076d6f83a4a4e9c1b5c0a0d876d4a9e52d0da7fbb6b9211393098b3d7794f1a5248cd7ce315a729601240a63c73de2c28372e0fd
- SSDEEP 384:nJrsSrs9tQi5gNMdmTcEzG56UtfFP5biZIjIN0tMtbe8CF7xGAZFu/2DCj6:nJtPi5GM8tUtfFP5biZIjIN0tybLCF7t
- TLSH
  T133B241046CF338524AB395FD5BE75402B2249D07B72CDEA1FACE83646F82151E6F62D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Havoc-main/payloads/Demon/CMakeLists.txt
- Size 2KB
- SHA256 eeafcbb2b1c0424a296e82d996793f806c3916ca29bc9ffb5bf41c2df62d8155
- MD5 ac54447fe01342b3f2eb7a16c6366b83
- SHA1 c57ffdfeb0d13167accef5dac5955047509a23f8
- SHA512 71edad3d1bc4967218c12894336916a84cf14815e7a1a08985e234c75eba9923923a79e916a95890bfa53fb0c8269d58649e3f64ebdd20ebeb0083884fd349ac
- TLSH
  T14741443F6C0E55735A2AA3EFA5E6520A4123DAD3AAA181DD3C9CCDD4CF663860102573
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  Havoc-main/payloads/Demon/scripts/hash_func.py
- Size 897B
- SHA256 ede73a0b3c3a552a203c0bca74f31e56f7bbb6054216124f484baf5909d3752a
- MD5 ddfc554f6a1c56562e48da0979b96a5d
- SHA1 35de0dc9d0a4f36ea942eeae853e93880c5776bf
- SHA512 322d0150cc308e85577719c30601ff5add287d401d93a1105a639051c5ba8d749dae7f1e7c677163cb861afb7a022c357ba28d2900f23b391b1c907229154374
- TLSH
  T1AD116B809F565C08C95247CD90E6D080131E383B2F1CA2BCF0EF1811DF83110A17BBB9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  Havoc-main/payloads/Demon/src/core/Win32.c
- Size 50KB
- SHA256 710ca8dd9632c7e66d275044d8be9462b69ca01850d79470ec135feac0c7f17f
- MD5 602bb657699303495946518233b9d8a9
- SHA1 6013f54a6db95aa7fa1d5c1ab1044faa836e9f80
- SHA512 5ea1b226a0a4f9008c7f02196526bc136c7c9e840b8a598819b3c9e0ef301e7fd70cf4086f44e2e9d321fa22ee1ed0ac1d006f92ddd7b8b36af39a7aefc62e73
- SSDEEP 384:WRHtevIhb8In7H32cFSesHgOD5sH/l8zwdKYmBFCeI1pfZp2Vyro6L0C5efwzW5r:Yf8UlsP1st8zwd9q0zW7HS0zkGF
- TLSH
  T1B633C50A57D3211ADA9B7934FBE7B8017A6980072729DD2C7C4C46C0AFA91F5C6B1FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Havoc-main/payloads/DllLdr/Scripts/extract.py
- Size 1KB
- SHA256 e99fa09b0fc6681a0860a32ccb1fa2e86d46b0ca93cfca3f39293ee431975f10
- MD5 654a7b57e9130d4e5397f18c3faa25ba
- SHA1 0c2e8eb9f2c22eeee8bd62ee14d8f58d5e0cd681
- SHA512 18329e642fb7cf0ace2e67bcc0bcadbbcef18b56cfa3a2b1eb566f770ea561e1204ca00ef4adef1ea91323a6a6fcf8c377196361012ed6aeac57ab1b7917d815
- TLSH
  T19D31DE51285277E057D3E67AFA7F4810C2BA760A62F098107F7C83D19FA1234CAA716F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  Havoc-main/payloads/Shellcode/Scripts/Hasher
- Size 15KB
- SHA256 4496f0463c444c8aca47383ed146476001d81f782a2f80dd54ebe0b540fa858a
- MD5 23a464c4d6259aa939382b4674aad6f9
- SHA1 957960c915ef5efa7d9a258c813ce5f90dee9a01
- SHA512 75b8d0f3b0286af371928c28fe93352316411056db0a6db65b38e7d367915b95aeb4055deae097a88274ac44b904400e8f19d909d3540068ede8d618ec36f576
- SSDEEP 96:RWQOgXTlB+BQwoAx1/NoCqtK3w7/fBHdBDvA/AnXUw1:R/JwmwN1FxADXBvAAn
- TLSH
  T19272210BA3E0CE7BCD18437C54E74B34A3B6E468577253232E04A2361E43B946E6A5DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Havoc-main/payloads/Shellcode/Scripts/extract.py
- Size 882B
- SHA256 64f8dca4328cbed486ee330d7693ad97a7d7fa6221308fc95d8f84dd7f9099d9
- MD5 0988d4a36293e96f87ed2ebf678daac4
- SHA1 59cb2ee726bcee98b857b5a126043fc86131748c
- SHA512 0c8f865665b783ffabe8db9d8965ac6af3b09c21c46ac8925669ea718e61a5eb25e584628b728fc8a0c17487785b75fe343d6241341338beb6718c5e5c389ba9
- TLSH
  T18F1125544803266189F717BC6F6EB8B0D121BE276211A839B10C27753F9032CF7F2B95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral18 behavioral19 behavioral20 behavioral21
- Target
  Havoc-main/teamserver/Install.sh
- Size 520B
- SHA256 20778003ac5b7c7ed7ac6ae3b337a947fba8aa6232f999351d49cc7f82ece8a6
- MD5 39223282f7d8d43b0aa744663c4065de
- SHA1 90cca73379e4d177021b0ea3d175c6fb8b35ced3
- SHA512 46d98d4d81923417f1624de337faf31ab38e29dc487b685a1f1fde5244887617b4df2985a1fc8a72e49149b2106f0eb3e67a35ac8a5df00c50117011802d51de
- TLSH
  T109F02B66674267F1134309051A43F1016807D3475F907F64FC4B1CF16B1073FB925D14
- MD5 SHA1 SHA512 TLSH
Score

7^/10

credential_access defense_evasion discovery persistence privilege_escalation execution
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
behavioral22 behavioral23 behavioral24 behavioral25
- Target
  Havoc-main/teamserver/cmd/server.go
- Size 1KB
- SHA256 2c923243804d3c9997252f85af35cfb41dd004ebf47fbe2c4000f53c7ce8e6bb
- MD5 0f49ad83dc73c88564fe8e4fb8e52bba
- SHA1 3d7f8afd1fc8b13ccbc27864de6f1806960fd092
- SHA512 a06240caee3bf877fea6e4cfb935dd7a40b7071b2ef51a45145c5ab31cf3823ed74ac461182f1d861e2845f47c60255c62f889be203215a2fb9595e34c149ccd
- TLSH
  T1AC41541AEB9C00EE0D58121D95C467C193AE8287831842FA779C55AF72C4E27A7E29B4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Havoc-main/teamserver/cmd/server/agent.go
- Size 6KB
- SHA256 53ae61f4fea8f7e3e6cc525dcbd30e10aa204a90ad0d14def787a5d2b4eca464
- MD5 d24513281250ad74c880b8ab898831ce
- SHA1 ef059a45689767d0a20e67def0e08800e45f9a8d
- SHA512 63db434eb036981da9d6ea8a82a3d15edd7668da0ef16ccc095cbbfe8effb5b8fd42ce2e5bdf06dff9a877ea0361d34ea1ff88bc28e9910f1a61ec6d82fd460f
- SSDEEP 96:Agr9UqbvxacVYt4JcQH4W7yzkx4IYzwjOa8jv5lgqa0/Z75jAa0ZuSdcAP215qag:zbZalwazwjqv5lgqXEupPfIn2ic3jC
- TLSH
  T129D1740FFBA805692B910DA8EDC59DC662BBC1D22D658CB4F2EE3CDE213A069517452C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Havoc-main/teamserver/cmd/server/dispatch.go
- Size 25KB
- SHA256 ddbec0a6d7a8e934ce5be5c585c9dba7e8484d9758cffb5d1d66144b59685485
- MD5 0b6f48a70d00a67aad8a157b62274411
- SHA1 b037ef734a623438f664985d7e2dbc73e4fc3e01
- SHA512 84d51eb0619e1d2002b1cccf491301313137792004a3999a14a3168eff9ca971ced9d516b2c3e499f041487477450bdd05b8d5f2fcff2b04d57c6466ca95c074
- SSDEEP 384:+uoevyav5qRPvEEMvUkuPR796SL+YY6f1oGSxYUzZ5m:+AvXvIRPvUv1uP3T7onmAm
- TLSH
  T128C2FF86A79C606F4708020DA69413D45ABDD6364834A0FFFCCAFDEC25C49DE86BCD68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  Havoc-main/teamserver/cmd/server/listener.go
- Size 10KB
- SHA256 a882a56c286f3089ba742592818e5e60181095a12b3c9a6bde730d958a9ab489
- MD5 adbdc1cd5caa148ab38d806c9db43ae3
- SHA1 631d73934d700c5596d7e566bb30a7b4ecf5d93d
- SHA512 26c9a8b8a2b0775ea24a1b694f0a24731e07fcd5e8391d7af3a6a70562675d228870a80e45c9963905fd021cd3607636e5022b2d0ea0e898b4219925a2edca98
- SSDEEP 192:joky3SmYctDYwm3nBLIxSdIxtsyvcqOuCeQwaoM8RSo2Vvzy5Z9VCw9nu88a0oD:jIizXfmsyEACdMRSz9U
- TLSH
  T10F22231F838C013B87C88216FDC952D42F2D9BB2582550E6E98EF5D9305ECEEC274AB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32