renamer | 6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854 | Triage

Submit
Reports

Overview

overview

Static

static

6accb094d1...4N.exe

windows7-x64

6accb094d1...4N.exe

windows10-2004-x64

Sharing

General

Target

6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854N
Size

824KB
Sample

241026-gqj8ra1bpf
MD5

d0e0be5b7077ccea082fdc6ec6d12870
SHA1

93f2055a1704c3f960da4c05ac3e6bf09e81f49e
SHA256

6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854
SHA512

8addbcb9d7e08da7159e9f979f5daee3cb2c76add025326b3adbeb0c696ac5ac921b7c50e8942dee9e829eea83772e14fa477341324f9ae054eb532efb11e836
SSDEEP

12288:cwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEi888888888888W8888888J:cNzCtUpQ9WWPBSSRMTEpXNo

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854N.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

10 signatures

120 seconds

Behavioral task

behavioral2

Sample

6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854N.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

120 seconds

Malware Config

Targets

- Target
  
  6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854N
- Size
  
  824KB
- MD5
  
  d0e0be5b7077ccea082fdc6ec6d12870
- SHA1
  
  93f2055a1704c3f960da4c05ac3e6bf09e81f49e
- SHA256
  
  6accb094d1cf98b41657e126cfb008f13d1cf1e9ed22c66638044020b44d8854
- SHA512
  
  8addbcb9d7e08da7159e9f979f5daee3cb2c76add025326b3adbeb0c696ac5ac921b7c50e8942dee9e829eea83772e14fa477341324f9ae054eb532efb11e836
- SSDEEP
  
  12288:cwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEi888888888888W8888888J:cNzCtUpQ9WWPBSSRMTEpXNo
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy