renamer | b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337 | Triage

Submit
Reports

Overview

overview

Static

static

b6ee74cc1b...7N.exe

windows7-x64

b6ee74cc1b...7N.exe

windows10-2004-x64

Sharing

General

Target

b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337N
Size

824KB
Sample

240921-r344ssxhjr
MD5

ae42ebf6aaed59df7a9906a5c062ec30
SHA1

3fe399a39295c9752801c01774a3e6b840f2eead
SHA256

b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337
SHA512

7f3098a3cbbdaa53bafcd6fc12f2f360dbd769933a7fba481ea67e99197b783e304e9c4b12fbe092b7e7076b882dd26dd1d6408ad38d45cc50a2b650b21fc776
SSDEEP

12288:GwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ghozE/888888888888W8888888J:GNzCtUpQ9WWPBSSRMTEplNL

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337N.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337N.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

120 seconds

Malware Config

Targets

- Target
  
  b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337N
- Size
  
  824KB
- MD5
  
  ae42ebf6aaed59df7a9906a5c062ec30
- SHA1
  
  3fe399a39295c9752801c01774a3e6b840f2eead
- SHA256
  
  b6ee74cc1b6501b3ba614be6856e8b808a98a289450b67edf116302e5806a337
- SHA512
  
  7f3098a3cbbdaa53bafcd6fc12f2f360dbd769933a7fba481ea67e99197b783e304e9c4b12fbe092b7e7076b882dd26dd1d6408ad38d45cc50a2b650b21fc776
- SSDEEP
  
  12288:GwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ghozE/888888888888W8888888J:GNzCtUpQ9WWPBSSRMTEplNL
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy