Overview

overview

10

Static

static

10

882039bfc4...18.exe

windows7-x64

10

882039bfc4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    882039bfc472411a53bd580e0010b0f0_JaffaCakes118

  • Size

    816KB

  • Sample

    241102-2bn9dawrbw

  • MD5

    882039bfc472411a53bd580e0010b0f0

  • SHA1

    3e836c7f109f9df8a877c013751ff33a98224354

  • SHA256

    3281438fc5eb8aff612ac9936862d40dd9eafbee03a6bb06973545613d2ce4a2

  • SHA512

    7bb3059fc1e6c9fdfb502764b862aee1d018482b1bf35753fe414b6017d6d6ffe19dba70f51272cfdadbd901fcf3bec60a5d37cf41f08da5ce4b9c7541a59ece

  • SSDEEP

    12288:gqkAx8i7pC8PapFTUt6xIuFrb9OKcEKfBKSNqvnSNgFCV4tuRf888888888888WX:N8i7pjPapFTUt6xIyHGBKSNqvn5m4tk0

Score
10/10
renamerdiscoverypersistenceworm

Malware Config

Targets

    • Target

      882039bfc472411a53bd580e0010b0f0_JaffaCakes118

    • Size

      816KB

    • MD5

      882039bfc472411a53bd580e0010b0f0

    • SHA1

      3e836c7f109f9df8a877c013751ff33a98224354

    • SHA256

      3281438fc5eb8aff612ac9936862d40dd9eafbee03a6bb06973545613d2ce4a2

    • SHA512

      7bb3059fc1e6c9fdfb502764b862aee1d018482b1bf35753fe414b6017d6d6ffe19dba70f51272cfdadbd901fcf3bec60a5d37cf41f08da5ce4b9c7541a59ece

    • SSDEEP

      12288:gqkAx8i7pC8PapFTUt6xIuFrb9OKcEKfBKSNqvnSNgFCV4tuRf888888888888WX:N8i7pjPapFTUt6xIyHGBKSNqvn5m4tk0

    Score
    10/10
    renamerdiscoverypersistenceworm

    • Detects Renamer worm.

      Renamer aka Grename is worm written in Delphi.

    • Renamer family

      renamer

    • Renamer, Grenam

      Renamer aka Grenam is a worm written in Delphi.

      wormrenamer

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks