renamer | af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3 | Triage

Submit
Reports

Overview

overview

Static

static

af94d879e6...a3.exe

windows7-x64

af94d879e6...a3.exe

windows10-2004-x64

Sharing

General

Target

af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3
Size

824KB
Sample

240910-blppsa1fqd
MD5

163ccc866d5d13b49a66b7d031953087
SHA1

2a5a054f7e8b5735658fd461c5db010917132a30
SHA256

af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3
SHA512

6409537fed4d60a9efa17230b4f670c4d6eb10e65ee1b75b8c63cf50d0e0b40a89fb36bbc3c2ba3a6adea7075affa5a048b4b5664e93088bb3fb304c46d62ea2
SSDEEP

12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEmN888888888888W888888E:jNzCtUpQ9WWPBSSRMTEpXNm

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3
- Size
  
  824KB
- MD5
  
  163ccc866d5d13b49a66b7d031953087
- SHA1
  
  2a5a054f7e8b5735658fd461c5db010917132a30
- SHA256
  
  af94d879e66657616e0f863c29a0e46392a73d68ffdd8ec5104961b98f44baa3
- SHA512
  
  6409537fed4d60a9efa17230b4f670c4d6eb10e65ee1b75b8c63cf50d0e0b40a89fb36bbc3c2ba3a6adea7075affa5a048b4b5664e93088bb3fb304c46d62ea2
- SSDEEP
  
  12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEmN888888888888W888888E:jNzCtUpQ9WWPBSSRMTEpXNm
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy