renamer | a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecda | Triage

Submit
Reports

Overview

overview

Static

static

a259a0074a...aN.exe

windows7-x64

a259a0074a...aN.exe

windows10-2004-x64

Sharing

General

Target

a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecdaN
Size

824KB
Sample

240923-a8a98s1fqp
MD5

6abdea98307886babb9409008ee79cd0
SHA1

9669231b1f2dfee71297310fcc445dcc0afc64a1
SHA256

a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecda
SHA512

7c83db756fe19e35e033009a7f11737c865e5e90622d4c6728fb814bc5fdf361885707588480d74441582d4096c69f6794304e7214d488acb9c6663c43a26c83
SSDEEP

12288:ZwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEX888888888888W8888888J:NNzCtUpQ9WWPBSSRMTEpXND

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecdaN.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecdaN.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

120 seconds

Malware Config

Targets

- Target
  
  a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecdaN
- Size
  
  824KB
- MD5
  
  6abdea98307886babb9409008ee79cd0
- SHA1
  
  9669231b1f2dfee71297310fcc445dcc0afc64a1
- SHA256
  
  a259a0074a46dff7963b9223826f8b8c7e683138a166b342a15d3e341d77ecda
- SHA512
  
  7c83db756fe19e35e033009a7f11737c865e5e90622d4c6728fb814bc5fdf361885707588480d74441582d4096c69f6794304e7214d488acb9c6663c43a26c83
- SSDEEP
  
  12288:ZwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEX888888888888W8888888J:NNzCtUpQ9WWPBSSRMTEpXND
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy