renamer | 8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df | Triage

Submit
Reports

Overview

overview

Static

static

8fee5a2777...df.exe

windows7-x64

8fee5a2777...df.exe

windows10-2004-x64

Sharing

General

Target

8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df
Size

824KB
Sample

241106-bcmttssbqa
MD5

fa2185ba1d7503b471d089eed573c560
SHA1

f63296d12629d20e190942159d97c4fb30b27f32
SHA256

8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df
SHA512

80fde5d8d120fce27012884993f8f3507ff3af538a1840b438af24cc9e11be80edf1ec50c4c71becaf3b114b1f027f3437e141f9d666cacdee11e4af166475de
SSDEEP

12288:nwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEw888888888888W8888888J:TNzCtUpQ9WWPBSSRMTEpXNq

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df
- Size
  
  824KB
- MD5
  
  fa2185ba1d7503b471d089eed573c560
- SHA1
  
  f63296d12629d20e190942159d97c4fb30b27f32
- SHA256
  
  8fee5a277797a25cc4f3635f6820762a7c5944d5e107731cc9c7dc7872c877df
- SHA512
  
  80fde5d8d120fce27012884993f8f3507ff3af538a1840b438af24cc9e11be80edf1ec50c4c71becaf3b114b1f027f3437e141f9d666cacdee11e4af166475de
- SSDEEP
  
  12288:nwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEw888888888888W8888888J:TNzCtUpQ9WWPBSSRMTEpXNq
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy