renamer | 49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623 | Triage

Submit
Reports

Overview

overview

Static

static

49014100cb...23.exe

windows7-x64

49014100cb...23.exe

windows10-2004-x64

Sharing

General

Target

49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623
Size

824KB
Sample

240917-znh7savapn
MD5

3b865678f89d294c881a7ddffce4f59f
SHA1

7e1fc60a9e89748fd84fa3fdb5ede6c0d9d88ccc
SHA256

49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623
SHA512

db3ce90ddd268cf29dfb1bbc366f9e9e266c29d465fe2a205a1ed95131a5c24dfd66107c32f36fbe8bc07c58f3dd9c7b7f240e8e189a225fda3bf10e0a01befd
SSDEEP

12288:OwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEH888888888888W8888888J:eNzCtUpQ9WWPBSSRMTEpXNz

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623
- Size
  
  824KB
- MD5
  
  3b865678f89d294c881a7ddffce4f59f
- SHA1
  
  7e1fc60a9e89748fd84fa3fdb5ede6c0d9d88ccc
- SHA256
  
  49014100cbac19118a77e73e97929e8437946803b686902508d105078eb0b623
- SHA512
  
  db3ce90ddd268cf29dfb1bbc366f9e9e266c29d465fe2a205a1ed95131a5c24dfd66107c32f36fbe8bc07c58f3dd9c7b7f240e8e189a225fda3bf10e0a01befd
- SSDEEP
  
  12288:OwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEH888888888888W8888888J:eNzCtUpQ9WWPBSSRMTEpXNz
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy