renamer | 70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7 | Triage

Submit
Reports

Overview

overview

Static

static

70c01089ab...c7.exe

windows7-x64

70c01089ab...c7.exe

windows10-2004-x64

Sharing

General

Target

70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7
Size

824KB
Sample

250119-dgyg8ssre1
MD5

5d68cb75614ded0ab4410d038630c833
SHA1

5b3e1fd539e15527f924430cb28b41f70859c90a
SHA256

70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7
SHA512

a847da9e49ae58642c612b8b78016de0da809dbfa7e0c2469b61bc5f3ca8628d377020f7cd26f6f552608c28bb219a947ea4df9acbaac284a4d761c5ef950a42
SSDEEP

12288:4wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEm888888888888W8888888J:YNzCtUpQ9WWPBSSRMTEpXNU

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7.exe

Resource

win7-20240729-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7
- Size
  
  824KB
- MD5
  
  5d68cb75614ded0ab4410d038630c833
- SHA1
  
  5b3e1fd539e15527f924430cb28b41f70859c90a
- SHA256
  
  70c01089abeaa55d7db84766677466209d651e92e740a31bef65284e60c894c7
- SHA512
  
  a847da9e49ae58642c612b8b78016de0da809dbfa7e0c2469b61bc5f3ca8628d377020f7cd26f6f552608c28bb219a947ea4df9acbaac284a4d761c5ef950a42
- SSDEEP
  
  12288:4wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEm888888888888W8888888J:YNzCtUpQ9WWPBSSRMTEpXNU
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy