Threat Description

Backdoor:W32/Havex

Details

Aliases: Havex.A, Havex
Category: Malware
Type: Backdoor
Platform: W32

Summary


Havex is a Remote Access Tool (RAT) used in targeted attacks. Once present on a machine, it scans the system and connected resources for information that may be of use in later attacks; the collected data is forwarded to remote servers.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.



Technical Details


Havex is known to have been used in attacks targeted against various industrial sectors, particularly the energy sector. Variants seen circulating in the spring of 2014 were modified to target organizations involved in developing or using industrial applications or appliances.

Distribution

Havex is known to be distributed to targeted users through:

  • Spam emails
  • Exploit kits
  • Trojanized installers planted on compromised vendor sites

For the last distribution channel, compromised vendor sites that were identified were related to companies involved in the development of applications and appliances used in industrial settings. The affected companies are based in Germany, Switzerland and Belgium.

Behavior

Once the Havex malware has been delivered to the targeted users and installed on a machine, it scans the system and connected resources accessible over a network for information of interest. This information includes the presence of any Industrial Control Systems (ICS) or Supervisory Control And Data Acquisition (SCADA) systems present in the network.

The collected data is then forwarded to compromised websites, which surreptitiously serve as remote command and control (C&C) servers.

For more technical details, see:






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More