renamer | 3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a | Triage

Submit
Reports

Overview

overview

Static

static

3e3f0a898d...0a.exe

windows7-x64

3e3f0a898d...0a.exe

windows10-2004-x64

Sharing

General

Target

3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a
Size

824KB
Sample

240910-zp1s8awfjh
MD5

bfc7c5ddc49a7f74c81184853ed857ef
SHA1

b0986ee44435ceee9f92151541e23acd0f01a4fe
SHA256

3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a
SHA512

78f8838c36704a211b84134db80d31b4df0de1e9f2ac3e3465e53ecf1ca9ffd479efced3b01c5e53c9c6e4ab0c37b075e42bf5bbc51eed4a5b44889ebea61c2e
SSDEEP

12288:MwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEe888888888888W8888888J:MNzCtUpQ9WWPBSSRMTEpXNM

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a
- Size
  
  824KB
- MD5
  
  bfc7c5ddc49a7f74c81184853ed857ef
- SHA1
  
  b0986ee44435ceee9f92151541e23acd0f01a4fe
- SHA256
  
  3e3f0a898dfc30b1fd05c438eeae133dd756470bcdbd9fc407b276abeef96f0a
- SHA512
  
  78f8838c36704a211b84134db80d31b4df0de1e9f2ac3e3465e53ecf1ca9ffd479efced3b01c5e53c9c6e4ab0c37b075e42bf5bbc51eed4a5b44889ebea61c2e
- SSDEEP
  
  12288:MwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEe888888888888W8888888J:MNzCtUpQ9WWPBSSRMTEpXNM
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy