renamer | 46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b | Triage

Submit
Reports

Overview

overview

Static

static

46bad64faf...7b.exe

windows7-x64

46bad64faf...7b.exe

windows10-2004-x64

Sharing

General

Target

46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b
Size

824KB
Sample

241227-1jnr5szrgp
MD5

c05b9583026a0f1837019b7bdcda0f46
SHA1

9a511a79e9a21cdfaef0ac309213c0006a49970c
SHA256

46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b
SHA512

1a49dc79cec48102c0f916ebb0a4d0f39ffc2d673efb6086a79998ca43d1ef63c46ab5162b36c77790eb23b3d383c89e3ea8a9b3a17780972ee1de6e53006780
SSDEEP

12288:ZwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEd888888888888W8888888J:NNzCtUpQ9WWPBSSRMTEpXNV

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b
- Size
  
  824KB
- MD5
  
  c05b9583026a0f1837019b7bdcda0f46
- SHA1
  
  9a511a79e9a21cdfaef0ac309213c0006a49970c
- SHA256
  
  46bad64faf4b96877c653f60e246514446c81f2a98dd4659fa4a67248aa2957b
- SHA512
  
  1a49dc79cec48102c0f916ebb0a4d0f39ffc2d673efb6086a79998ca43d1ef63c46ab5162b36c77790eb23b3d383c89e3ea8a9b3a17780972ee1de6e53006780
- SSDEEP
  
  12288:ZwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEd888888888888W8888888J:NNzCtUpQ9WWPBSSRMTEpXNV
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy