renamer | d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9 | Triage

Submit
Reports

Overview

overview

Static

static

d889258d87...e9.exe

windows7-x64

d889258d87...e9.exe

windows10-2004-x64

Sharing

General

Target

d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9
Size

824KB
Sample

240912-cnxnvawcqp
MD5

285aa6b54d856f1c9bfffaac800325da
SHA1

e78ab2942875a3d2caab74ec8f22b2d15211f047
SHA256

d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9
SHA512

58920f2a12f11926e7b21724bbf7d382d1f9b960ae8ca455a7f6c6ed1275aad917fec7eac37e4c0cd32cdd1ea17268e6838091a74e2a411750f9914fbdb75be1
SSDEEP

12288:GwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEa888888888888W8888888J:GNzCtUpQ9WWPBSSRMTEpXNg

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9
- Size
  
  824KB
- MD5
  
  285aa6b54d856f1c9bfffaac800325da
- SHA1
  
  e78ab2942875a3d2caab74ec8f22b2d15211f047
- SHA256
  
  d889258d87415e13da2ad919bf681bfa3ffe44892158cebf8be4a175b28c47e9
- SHA512
  
  58920f2a12f11926e7b21724bbf7d382d1f9b960ae8ca455a7f6c6ed1275aad917fec7eac37e4c0cd32cdd1ea17268e6838091a74e2a411750f9914fbdb75be1
- SSDEEP
  
  12288:GwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEa888888888888W8888888J:GNzCtUpQ9WWPBSSRMTEpXNg
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy