Black friday Up to 3 extra licenses FOR FREE + Special offer for TI LOOKUP Get it now
Webinar
February 26
Better SOC with Interactive Sandbox Practical Use Cases
Register now

Havoc

130
Global rank
110 infographic chevron month
Month rank
88 infographic chevron week
Week rank
0
IOCs

Havoc is an advanced post-exploitation framework used by hackers to take control of a system once they've breached it. With Havoc, attackers can run commands remotely, inject malicious processes, and access sensitive data. It's often used in targeted attacks, allowing cybercriminals to stay hidden in a network while stealing information or launching further attacks. Its flexibility and ability to bypass detection make it a serious threat, especially in environments that rely on traditional security tools.

C2 Framework
Type
Unknown
Origin
1 October, 2022
First seen
12 March, 2025
Last seen

How to analyze Havoc with ANY.RUN

C2 Framework
Type
Unknown
Origin
1 October, 2022
First seen
12 March, 2025
Last seen

IOCs

IP addresses
172.205.115.95
177.68.42.191
185.43.5.227
51.21.171.165
52.169.163.36
159.223.73.228
185.215.54.195
86.54.42.182
43.128.147.70
213.209.143.31
44.209.63.85
57.129.16.213
23.227.202.132
185.158.94.217
45.154.98.173
94.156.67.244
161.35.239.147
91.237.124.162
210.2.169.247
179.60.150.151
Domains
cpcalendars.toptenufabetgames.xyz
cpcalendars.newzofnetworksera.com
cpcalendars.topgadgettechnewz1.xyz
cpcontacts.teamofufabetgames.xyz
cpcalendars.apexhomeimprovement.xyz
cpcontacts.sports777games.com
cpcalendars.shalownewsbooks.com
webdisk.totobestliv.com
cpcalendars.dmhubnewsz.website
cpcalendars.livebengsnnewz.xyz
cpcontacts.techspilotx.website
cpanel.sportsfootball.website
cpcontacts.whartpzz.com
cpcontacts.handufabetgames.xyz
outlook.tekbalam.com
webmail.bestnewznetworks.com
webmail.apexhomeimprovement.xyz
cpcalendars.newdmkey.xyz
cpanel.theyestechnewsz.xyz
cpanel.games777games.xyz
Last Seen at

Recent blog posts

post image
AI Safety: Key Threats and Solutions 
watchers 237
comments 0
post image
5 Common Evasion Techniques in Malware 
watchers 376
comments 0
post image
How Transport Company Gets Real-Time IOC and...
watchers 1176
comments 0

What is Havoc malware?

Havoc is a post-exploitation framework used by cybercriminals and penetration testers to perform a variety of attacks and gain deeper control over compromised systems. It is developed by C5pider, written in Golang, C++, and C.

First observed in 2022, it has become notable for its stealth, flexibility, and use of encrypted communications to avoid detection. The malware is used in advanced campaigns, often by threat actors conducting highly targeted attacks.

It has been linked to attacks targeting corporate networks, critical infrastructure, and government entities.

Key technical details include its ability to use reflective DLL injection and direct memory manipulation to execute payloads. It maintains persistence on compromised systems through registry modifications and scheduled tasks, while its communication with command-and-control (C2) servers is highly encrypted

Get started today for free

Analyze malware and phishing in a fully-interactive sandbox

Create free account

Havoc malware technical details

Havoc malware has several powerful and dangerous capabilities, making it a significant post-exploitation tool. Some of its primary technical features include:

  • Uses reflective DLL injection to inject its payloads directly into the memory of a process without writing to disk, minimizing the risk of detection.
  • Can perform direct memory manipulation to execute malicious code.
  • Supports multiple communication channels (HTTP/HTTPS, DNS, SMB), all encrypted using TLS, making it difficult to intercept and analyze its traffic.
  • Includes a shellcode loader, capable of disabling Event Tracing for Windows (ETW) and performing system reconnaissance.
  • Can establish persistence using methods such as registry modifications, scheduled tasks, and service creation.
  • Allows operators to upload, download, and manipulate files remotely, which is a key post-exploitation feature for attackers.

Havoc operates primarily as an open-source framework and is typically distributed through phishing campaigns or malicious downloads. Its advanced features include payload generation, encryption (using algorithms like AES and RSA), process injection techniques, and multiple communication channels (HTTP, HTTPS, DNS, and SMB).

Havoc malware execution process

To see how Havoc operates, let’s upload a Havoc sample to the ANY.RUN sandbox.

After executing the sample in the sandbox, the first thing that stands out is the red label in the upper right corner of the screen. This label provides a quick way to determine whether the activity is malicious. In our case, it’s highlighted in red, confirming that the behavior is indeed malicious.

Havoc in ANY.RUN sandbox Analysis of Havoc in the ANY.RUN sandbox

The ANY.RUN sandbox provides a Suricata rule flagging Havoc’s suspicious network activity, which is further evidence of its malicious behavior.

Havoc Suricatain ANY.RUN Malicious network activity detected by Suricata IDS in the ANY.RUN sandbox

The Havoc framework establishes a Command and Control (C2) channel using encrypted protocols such as HTTPS and SMB to evade detection. Its modular architecture allows for functionalities like privilege escalation, lateral movement, and data exfiltration. The core agent, "Demon," written in C and Assembly, uses techniques like indirect syscalls for Nt* APIs, x64 return address spoofing, and sleep obfuscation to bypass defenses.

Havoc offers capabilities such as:

  • Stagers: Lightweight payloads that establish a foothold.
  • Shellcode injectors: Inject shellcode into remote processes, allowing execution without disk traces.
  • Reflective DLL loaders: Bypass traditional antivirus by loading DLLs directly into memory.
  • Custom plugins: Support for credential harvesting, keylogging, and system information gathering.

It supports execution with Beacon Object Files (BOFs), enabling direct memory interaction, and can execute commands using cmd.exe and powershell.exe and is capable of deploying additional payloads to infected systems. Havoc employs advanced evasion techniques, such as process injection and anti-VM/sandbox checks.

For persistence, Havoc can modify system settings, create scheduled tasks, or alter startup configurations, ensuring continued control over compromised systems.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Havoc malware distribution methods

Havoc malware is distributed through a variety of methods that are commonly seen in advanced cyber threats:

  • Phishing emails: Havoc can be delivered via phishing campaigns, where malicious attachments or links are included in seemingly legitimate emails. These attachments often contain malicious macros or scripts that launch the malware once opened by the victim.
  • Malicious downloads: Attackers may trick users into downloading Havoc through fake software updates, cracked software, or malicious files hosted on compromised websites. These files may appear harmless but execute the malware when run.
  • Exploitation of vulnerabilities: Havoc can be deployed by exploiting known software vulnerabilities in operating systems or third-party applications, allowing attackers to gain access to systems remotely.
  • Malvertising: Havoc could be spread via malicious advertisements that redirect users to compromised or malicious websites where the malware is downloaded.

Gathering Threat Intelligence on Havoc Malware

To collect the latest intelligence on Havoc malware, utilize Threat Intelligence Lookup.

This service allows you to access a vast database with insights from millions of malware analysis sessions in the ANY.RUN sandbox. You can customize your search using over 40 different parameters, such as IP addresses, file names, command line artifacts, and process indicators, to find relevant details on Havoc and its behavior.

Havoc in TI Lookup ANY.RUN Search results for Havoc in Threat Intelligence Lookup

For example, by searching for Havoc's threat name (threatName:"Havoc"), you can uncover related samples and sandbox analysis results. This helps security professionals stay up to date on malware's evolution and techniques.

Start exploring these capabilities with a 14-day free trial of Threat Intelligence Lookup, alongside the ANY.RUN sandbox for deep, real-time analysis.

Conclusion

Havoc poses a significant threat due to its advanced evasion techniques, process manipulation, and ability to execute malicious payloads, making it highly dangerous for businesses. To protect against such threats, it’s important to carry out proactive malware analysis of suspicious files and URLs.

ANY.RUN provides real-time threat detection, allowing users to explore malware behavior, gather detailed reports on malware, such as Havoc.

Sign up for a free ANY.RUN account today and start analyzing threats in real-time!

HAVE A LOOK AT

DarkTortilla screenshot
DarkTortilla
darktortilla
DarkTortilla is a crypter used by attackers to spread harmful software. It can modify system files to stay hidden and active. DarkTortilla is a multi-stage crypter that relies on several components to operate. It is often distributed through phishing sites that look like real services.
Read More
zgRAT screenshot
zgRAT
zgrat
zgRAT is a malware known for its ability to infect systems and exfiltrate sensitive data to command-and-control (C2) servers. It is primarily distributed through loader malware, as well as phishing emails. zgRAT employs various advanced techniques, including process injection and code obfuscation, to evade detection and maintain persistence on infected systems. The malware can also spread via USB drives and uses popular messaging platforms like Telegram and Discord for data exfiltration.
Read More
BlackMoon screenshot
BlackMoon
blackmoon
BlackMoon also known as KrBanker is a trojan aimed at stealing payment credentials. It specializes in man-in-the-browser (MitB) attacks, web injection, and credential theft to compromise users' online banking accounts. It was first noticed in early 2014 attacking banks in South Korea and has impressively evolved since by adding a number of new infiltration techniques and information stealing methods.
Read More
SSLoad screenshot
SSLoad
ssload
SSLoad is a malicious loader or downloader that is used to infiltrate target systems through phishing emails, perform reconnaissance and transmit it back to its operators delivering malicious payloads. To avoid detection, SSLoad employs various encryption methods and delivery techniques highlighting its versatile nature and complexity. It is believed to be a part of Malware-as-a-Service (MaaS) operation given its diverse delivery methods and implemented techniques.
Read More
Black Basta screenshot
Black Basta
blackbasta
Black Basta is a ransomware-as-a-service operated by Storm-1811. It emerged in 2022 and uses double extortion tactics, encrypting data and stealing it for ransom. The malware often gains access through spear-phishing and uses tools like QakBot and Cobalt Strike. It's known for exploiting system vulnerabilities and using advanced obfuscation techniques.
Read More
Quasar RAT screenshot
Quasar RAT
quasar trojan rat
Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.
Read More