Repository containting original and decompiled files of TRISIS/TRITON/HATMAN malware
Clone or download
MDudek-ICS Merge pull request #4 from anton-shipulin/master
Correct link for Tristation LUA dissector
Latest commit 8132fc2 Nov 27, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
decompiled_code init Dec 24, 2017
original_samples Update Readme Dec 25, 2017
symbolic_execution move symbolic resources to new folder Jul 12, 2018
yara_rules add yara rules Dec 24, 2017
.gitignore Executing Triton malware using ANGR symbolic execution engine. Apr 17, 2018 Merge pull request #4 from anton-shipulin/master Nov 27, 2018

TRISIS / TRITON / HatMan Malware Repository


This repository contains original samples and decompiled sources of malware attacking commonly used in Industrial Control Systems (ICS) Triconex Safety Instrumented System (SIS) controllers. For more information scroll to "Learn More".

Each organization describing this malware in reports used a different name (TRISIS/TRITON/HatMan). For that reason, there is no one, common name for it.

Folder original_samples contains original files used by the malware that could be found in the wild:

Name MD5 Contains MD5
trilog.7z 0b4e76e84fa4d6a9716d89107626da9b trilog.exe 6c39c3f4a08d3d78f2eb973a94bd7718
library.7z 76f84d3aee53b2856575c9f55a9487e7 0face841f7b2953e7c29c064d6886523
imain.7z d173e8016e73f0f2c17b5217a31153be imain.bin 437f135ba179959a580412e564d3107f
all.7z 5472e9e6d7fcb34123286878e1fecf85 All files above -

All archives are secured with password: infected

Folder decompiled_code contains decompiled python files, originating from trilog.exe file and archive described above:

Origin Result Method
trilog.exe unpy2exe + uncompyle6 Files in folder library uncompyle6

Folder yara_rules contains yara rules (that I am aware of) detecting this malware:

File Author
mandiant.yara @itsreallynick (Mandiant)
ics-cert.yara DHS/NCCIC/ICS-CERT

Folder symbolic_execution contains script for running imain.bin with ANGR symbolic execution engine – credits to @bl4ckic3

Why Publishing? Isn't it dangerous?

Some people in the community were raising the issue that publishing the samples and decompiled sources might be dangerous. I agreed until these were not public. I have found the included files in at least two publicly available sources, that means anyone can download it if know where to search. What is more, I believe that organizations/people who could be able to reuse it and have the capability to deploy it in a real attack have already accessed it long time ago. This repository makes it more accessible for community and academia who might work on improving defense solutions and saves some time on looking for decompilers.

Learn more

Technical Analysis:


News Publications:



Any updates to the repository are warmly welcome

Currently looking for the missing inject.bin (0544d425c7555dc4e9d76b571f31f500) file