Procedure examples

Havoc can download files from the victim's computer.

Havoc has a module for network enumeration including determining IP addresses.

The Havoc demon can check for a connection to the C2 server from the target machine.

Havoc features a module capable of host enumeration.

Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.

Havoc can trigger exection of `whoami` on the target host to display the current user.

Havoc has DLL spawn and injection modules.

Havoc has itself injected into `C:\\Windows\\System32\\Werfault.exe` on targeted systems.

Havoc can enumerate processes on targeted hosts.

Havoc can facilitate the execution of PowerShell commands.

Havoc can execute commands via `cmd.exe`.

Havoc can use HTTP/S listeners to establish and maintain C2 communications.

Havoc can use an SMB listener for C2 communication.

Havoc can gather system information including hostname, domain, and OS details.

The Havoc interface can display a file explorer view of the compromised host.

Havoc can identify privileged user accounts on infected systems.

Havoc has the ability to route HTTP/S communications through designated proxies.

Havoc has the ability to upload files to infected systems.

Havoc can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.

Havoc can capture screenshots.

Havoc has a module capable of token impersonation.

Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.

The Havoc infection chain has been initiated via ClickFix lures in phishing emails.

The Havoc demon agent can be set to sleep for a specified time.

The Havoc SMB demon can use named pipes for communication through a parent demon.

Havoc has been distributed through ClickFix phishing campaigns.

Havoc has the ability to copy files from one location to another.

Havoc can send an AES encrypted check-in request to the C2 server.

Havoc has leveraged legitimate executables to side-load malicious payloads.