Havex Rat

[DNR]

I need a copy of the full source.

DNR

[bad_brain]

hmmm......would be cool to have the hash, then you could run a search on vxheaven (yes, vxheaven IS back!! )....

[DNR]

yea been checking kernelmode.info (needs account)
check out - cybercrime-tracker.net

no hash available. Related to Energetic Bear

DNR

[maboroshi]

perhaps this pastebin will help you?

Code: Select all

http://pastebin.com/2x1JinJd

Edit * nvm seems all the links posted in this document are dead.

[scatter]

humm let s see what we can find give me some time for that

[scatter]

This article was removed http://itsec.webhostservices.biz/category/havex-rat/" onclick="window.open(this.href);return false;
and it was posted in Jan 22, 2014 but it can be found again here https://web.archive.org/web/20140125124 ... havex-rat/" onclick="window.open(this.href);return false;

and it s said

“It’s well built. The people who had it built had more capable programmers than we’ve typically seen with the Chinese-based adversary,” said Myers

so Myers (whom I don t know who he is) seems to have the code and maybe u wanna look here

http://research.zscaler.com/2014/03/lig ... ector.html" onclick="window.open(this.href);return false;

well just a quick look and update after 2 a.m so will find it later

[DNR]

nice you tripped over - http://pastebin.com/u/Sug4r" onclick="window.open(this.href);return false;

(yes, dox that person)

Good use of wayback machine.

I am sure there is a discussion or even sale of this tool on a private forum somewhere - just have to check em..

DNR

[DNR]

check out Lightsout Exploit kit - http://malwageddon.blogspot.com/2013/09 ... -fish.html" onclick="window.open(this.href);return false;

and

http://www.exploit-db.com/exploits/25294/" onclick="window.open(this.href);return false;

DNR

[DNR]

check the code - it may be "Hello" now - http://vrt-blog.snort.org/2014/03/hello ... t-kit.html" onclick="window.open(this.href);return false;

DNR

[scatter]

gotcha , will take care of that