MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Trigona


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce
SHA3-384 hash: d024eaffef5c4f0dd0ed607ab6d750761499886ec62ad5f177ec0ac8a33de3d2f4f50725beb22b43f4a1dbe6a376e1b5
SHA1 hash: f8ffa4f851d54844e15a74271b7d5e218496dca3
MD5 hash: 39fac17fb009f7995348e9265ca983a9
humanhash: charlie-ohio-football-jersey
File name:38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce
Download: download sample
Signature Trigona
Create hunting rule
File size:494'080 bytes
First seen:2025-02-12 07:20:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 84697658cd014320c1e7e6d305d61499 (10 x Trigona)
ssdeep 6144:rZfaSk7FR/pdPYIEQu0JriuXDeEIBN+dx8QN7knC2tpwBQ1yPqqDLulG6cHKARs8:1zIRxdDRe+8i2QN7kC2bqnumfn4Afl
TLSH T150B4292FB294CB78D1E6C13F8C92CF509532B8A8073695FB30D102A5DF556D0AD3AB69
TrID 77.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
14.1% (.EXE) Win64 Executable (generic) (10522/11/4)
2.7% (.EXE) OS/2 Executable (generic) (2029/13)
2.6% (.EXE) Generic Win/DOS Executable (2002/3)
2.6% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter TheRavenFile
Tags:exe Ransomware Trigona


Avatar
RakeshKrish12
Source: https://github.com/TheRavenFile/Daily-Hunt/blob/main/Trigona%20Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
518
Origin country :
IN IN
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce
Verdict:
Malicious activity
Analysis date:
2025-02-12 07:24:22 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/8fe63389-f8e4-441c-89d1-ecbcd9e499bf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Ransomware.Genie-10019460-0
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ac4bb86ddd91410acce073
Tags:
ransomware dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
DNS request
Network activity
Verdict:
Malicious
Labled as:
Ransom.Trigona.A.Generic
Link:
https://www.hybrid-analysis.com/sample/38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Trigona
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5fd6f87b-dc11-46ba-86e0-92a889ca9ce5
Result
Threat name:
Available For Trial
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1612820
Signature
Antivirus / Scanner detection for submitted sample
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Multi AV Scanner detection for submitted file
Yara detected Available For Trial Ransomware
Yara detected RansomwareGeneric
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce/
Threat name:
Win64.Ransomware.Trigona
Create hunting rule
Status:
Malicious
First seen:
2024-03-13 12:51:12 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hd2yujjwwxobq5j3y4zfz3axx2ad5ltbhaznnzxfpn3t7o4kidha._file
Result
Malware family:
trigona
Create hunting rule
Score:
  10/10
Tags:
family:trigona credential_access discovery ransomware spyware stealer
Link:
https://tria.ge/reports/250212-h6xz8asjcv/
Behaviour
Browser Information Discovery
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops desktop.ini file(s)
Credentials from Password Stores: Windows Credential Manager
Drops startup file
Reads user/profile data of web browsers
Trigona
Trigona family
Verdict:
Malicious
Tags:
Win.Ransomware.Genie-10019460-0
YARA:
n/a
Link:
https://app.threat.zone/submission/dc46bab8-77e9-4930-b3d1-809e140d828e
Unpacked files
SH256 hash:
38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce
MD5 hash:
39fac17fb009f7995348e9265ca983a9
SHA1 hash:
f8ffa4f851d54844e15a74271b7d5e218496dca3
Link:
https://www.unpac.me/results/e33f98ab-0096-4288-9c40-a5de7ebfde75/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38f58a2536b5dc18753bc7325cec17be803eae613832d6e6e57b773fbb8a40ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:Detects command variations typically used by ransomware
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments