Skip to main content

Havoc

Malware Family

633 indicators of compromise attributed to Havoc across abuse.ch threat intelligence feeds.

Domains

14

IPs

433

URLs

4

Hashes

182

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (14)IPs (433)URLs (4)Hashes (182)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
carrolc.comdomain
cwrtwright.comdomain
cdn.discussl.comdomain
triage-test.evilpony.windomain
cf.evilpony.windomain
webex-online.chdomain
cybercourse.prodomain
wawsenti.duckdns.orgdomain
msoffice360.comdomain
banyun-bao.topdomain
api.simsys.orgdomain
mail.kakitangan.camdomain
avlc2.westus2.cloudapp.azure.comdomain
caregiveme.orgdomain
91.134.139.176ip
82.221.139.243ip
64.225.65.17ip
217.154.162.45ip
5.78.212.208ip
45.32.58.238ip
86.54.42.94ip
161.97.173.185ip
192.236.148.154ip
82.23.146.219ip
77.81.139.66ip
89.223.95.22ip
162.243.160.70ip
95.133.166.10ip
38.242.209.29ip
20.188.119.195ip
147.93.9.173ip
92.51.46.35ip
167.88.166.42ip
66.97.33.99ip
https://cdn.discussl.com/api/v2/authurl
https://cdn.discussl.com/content/images/galleryurl
https://thomphon.com/api/v1/telemetryurl
https://ed75a310.infinityindians.pages.dev/ktool.exeurl
4022133358853a9c42167dbd4493195146cb54f06a6e023b170ab1cccc5c00a1hash
33d103a950e97fb4c0f28d8cff985ba6hash
f1b1e66de0451e6a9f53afdf2dfbf86be1bc9d520a67a43cfce4a6d4f805a9cbhash
b953ef3b1dd6e08d2179ae23624e0051c15754656d97fb8ca2461416360b05bfhash
8c5d48dfdb6c4ccaf83632883409198faa0dde2d71b3325bb79128b66a8d82e3hash
c1ad5175c7bab5034190059579712b2d38bd010fec191b00a3709b54cd446967hash
54f5603c31f360beaf872181bf60e0c65c86b2d1c256408991cf6e3d0f362d32hash
b24e7c066b84d327678fea4ddefafb2db2fe2002e17a81845ad5f2fb38d4f444hash
904bb06ad9ad3c8e4aa980b96cbecad85c14bd994af013d77121723c85a5e1a9hash
6dc22f5219df313970b7cdb63a64113f8be9a3edc80e9893eeff2987e9eb3623hash
d802bdaad6713549b5098d3545e07794900869c01a68024a1282fea74d40c4a3hash
1b151dd1b1ca636550029602ee88eae182a4143fef630a608647f4b027051a9ahash
37db74894bc92038ee310c7989705e56b21b559d9188931994af0b58b1752b2ahash
e8d6ea0246b56452df932427cbd3ac450162eaa354c774aedd77e2c68d066a5bhash
d9881976aeb8feccc000633f650219fbc5b794b7046aa3f30b5d0b4388980fa9hash
e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534ahash
9fa115d3d46b66b198a3d64fccba76e1bdc13f9fffacf19a9097a7f1cd7e92b4hash
d4163f1179d58f842ba3b9cd28cd315de031669b93d87111c40fbc13167e42abhash
f9ae4e66cd2ce7a2332fdf8097d7a176b590e8cdc1deaeeaeb6e03cb7b97bc7dhash
a7fb7ce962f2b6cdbd92f97150b669e81893dc7b5fb06c28758f4041bf8244dfhash

Another file to check? Run a file hash reputation check.