renamer | f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51 | Triage

Submit
Reports

Overview

overview

Static

static

f028ba43c0...1N.exe

windows7-x64

f028ba43c0...1N.exe

windows10-2004-x64

Sharing

General

Target

f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51N
Size

824KB
Sample

240920-nas92stdkr
MD5

0c60d1eef39bdaf52a6ce5f37b5a4230
SHA1

c10100bc22bc4a5a6dcbaa102affdd2acb9db6d7
SHA256

f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51
SHA512

e6da74d4e749febc0eb28bb504d8ececc903b17abc97fc408df3ec8ecd6d69c1266cfd3ab3985132893af722390cdbacb570126a78976b5fbb16f55ddc0ff0e2
SSDEEP

12288:UwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEU888888888888W8888888J:kNzCtUpQ9WWPBSSRMTEpXNm

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51N.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51N.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

120 seconds

Malware Config

Targets

- Target
  
  f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51N
- Size
  
  824KB
- MD5
  
  0c60d1eef39bdaf52a6ce5f37b5a4230
- SHA1
  
  c10100bc22bc4a5a6dcbaa102affdd2acb9db6d7
- SHA256
  
  f028ba43c00cce81834f95519a7b5e539466933f83a5ad24c83302508614be51
- SHA512
  
  e6da74d4e749febc0eb28bb504d8ececc903b17abc97fc408df3ec8ecd6d69c1266cfd3ab3985132893af722390cdbacb570126a78976b5fbb16f55ddc0ff0e2
- SSDEEP
  
  12288:UwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEU888888888888W8888888J:kNzCtUpQ9WWPBSSRMTEpXNm
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy