Havoc C2 Demon Config Extractor

Standalone tool to extract C2 configuration from Havoc Demon payloads wrapped in Headlace loaders.

Created by: r3nzsec

Extraction Pipeline

Outer PE .data → AES-128-CBC decrypt → shellcode → embedded Demon DLL → .data section → UTF-16LE config strings

Extracted Fields

Field	Description
C2_Host	C2 server hostname(s) or URL(s)
C2_IP	C2 server IP address(es)
C2_Port	C2 communication port
HTTP_Method	HTTP method used for C2 comms
User_Agent	User-Agent string
HTTP_Headers	Additional HTTP headers
Sleep	Beacon sleep interval
Jitter	Sleep jitter percentage
Injection_x64	64-bit process injection target
Injection_x86	32-bit process injection target
AES_Key	AES-128 encryption key (hex)
AES_IV	AES-128 IV (hex)

Usage

Windows (pre-built binary — no dependencies)

havoc_extractor.exe payload.bin
havoc_extractor.exe --json payload.bin
havoc_extractor.exe sample1.bin sample2.bin sample3.bin

Python (cross-platform)

pip install pefile cryptography
python havoc_extractor.py payload.bin
python havoc_extractor.py --json payload.bin

Building the .exe from source

pip install pyinstaller pefile cryptography
python -m PyInstaller --onefile --name havoc_extractor havoc_extractor.py

Example Output

============================================================
  Havoc C2 Demon Config — payload.bin
============================================================
  Framework           : Havoc C2
  Agent_Type          : Demon
  C2_Host             : https://malicious-c2.example.com
  C2_Port             : 443
  HTTP_Method         : POST
  User_Agent          : Mozilla/5.0 (Windows NT 10.0; Win64; x64)
  Sleep               : 5000
  Jitter              : 20
  Injection_x64       : C:\Windows\System32\notepad.exe
  Injection_x86       : C:\Windows\SysWOW64\notepad.exe
  Encryption          : AES-128-CBC (Headlace)
  AES_Key             : aabbccdd...
  AES_IV              : 11223344...
============================================================