Overview

overview

10

Static

static

3

version.dll

windows10-2004-x64

10

version.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    version.dll.exe
  • Size 291KB
  • Sample260928-ltfrysab38
  • SHA256 99a4f65abf325fde65795e2a7f215c0e30a57e5e8485da2a09e9aa89fa892c25
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
havocbackdoordiscovery

Malware Config

Extracted

Family

  • havoc

C2

  • 34.116.132.157

Attributes
  • spawn

    C:\Windows\System32\notepad.exe

    C:\Windows\SysWOW64\notepad.exe

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Targets

    • Target
      version.dll.exe
    • Size 291KB
    • SHA256 99a4f65abf325fde65795e2a7f215c0e30a57e5e8485da2a09e9aa89fa892c25
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryhavoc

    • Detects Havoc payload

    • Family: Havoc, HavocC2

      Havoc is an open-source backdoor and post-exploitation framework written in C++.

      backdoorhavoc

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks