renamer | 30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b | Triage

Submit
Reports

Overview

overview

Static

static

30b43fe2b9...0b.exe

windows7-x64

30b43fe2b9...0b.exe

windows10-2004-x64

Sharing

General

Target

30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b
Size

824KB
Sample

241105-zz8a2sxrcs
MD5

fbffc2e807032185f01d9eab993e7540
SHA1

2c9a7be1d089201df68fe5b620912fa7d2db024e
SHA256

30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b
SHA512

24df39d204805679b5c68970574cfcac2cf10591f6e3fb6e58ab33fcf7e871ad577259c09a9d8be6798c0d8c9a99a3d3108bbc31d68f2a71f7218d93db870cff
SSDEEP

12288:wwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEt888888888888W8888888J:gNzCtUpQ9WWPBSSRMTEpXNl

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b.exe

Resource

win7-20240708-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b
- Size
  
  824KB
- MD5
  
  fbffc2e807032185f01d9eab993e7540
- SHA1
  
  2c9a7be1d089201df68fe5b620912fa7d2db024e
- SHA256
  
  30b43fe2b9f3c9e87bc7736540fa1ba543e262da25c08f4073bab915d8614d0b
- SHA512
  
  24df39d204805679b5c68970574cfcac2cf10591f6e3fb6e58ab33fcf7e871ad577259c09a9d8be6798c0d8c9a99a3d3108bbc31d68f2a71f7218d93db870cff
- SSDEEP
  
  12288:wwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEt888888888888W8888888J:gNzCtUpQ9WWPBSSRMTEpXNl
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy