Havoc Across the Cyberspace

This report analyzes an in-the-wild campaign delivering the Havoc Demon post-exploitation implant: infection begins with a ZIP containing a BAT2EXE-compiled screensaver downloader that retrieves a signed shellcode loader (pics.exe) from http://146.190.48.229, which decrypts and executes a KaynLdr shellcode to reflectively map the Havoc DLL; the analysis documents ETW patching, API hashing, RWX allocation, AES-encrypted C2 communications, configuration values, available commands, and supporting IoCs and evasion techniques.