renamer | 2228b2d9206a8ab0d4460b9f700ddbf07cc7cd38e7c76b3e424832334172d1e4 | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...59.exe

windows7-x64

JaffaCakes...59.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_f9368945b430a4ec779ef36b1d61a259
Size

824KB
Sample

250214-shtyrs1phn
MD5

f9368945b430a4ec779ef36b1d61a259
SHA1

2094e9aee795b8e43d2def59bc05a5356e6784cb
SHA256

2228b2d9206a8ab0d4460b9f700ddbf07cc7cd38e7c76b3e424832334172d1e4
SHA512

bcf3a85d0922eff4c139bba019cb369b266ac8c13119e64ee3341466658c7a5647f1fde1cf7ae0f686b3748da4440b0e65928e3d888d693bfa724a83e8c7b3ea
SSDEEP

12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozE91888888888888W888888E:jNzCtUpQ9WWPBSSRMTEpXNz

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_f9368945b430a4ec779ef36b1d61a259.exe

Resource

win7-20241023-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_f9368945b430a4ec779ef36b1d61a259.exe

Resource

win10v2004-20250207-en

renamer discovery worm

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_f9368945b430a4ec779ef36b1d61a259
- Size
  
  824KB
- MD5
  
  f9368945b430a4ec779ef36b1d61a259
- SHA1
  
  2094e9aee795b8e43d2def59bc05a5356e6784cb
- SHA256
  
  2228b2d9206a8ab0d4460b9f700ddbf07cc7cd38e7c76b3e424832334172d1e4
- SHA512
  
  bcf3a85d0922eff4c139bba019cb369b266ac8c13119e64ee3341466658c7a5647f1fde1cf7ae0f686b3748da4440b0e65928e3d888d693bfa724a83e8c7b3ea
- SSDEEP
  
  12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozE91888888888888W888888E:jNzCtUpQ9WWPBSSRMTEpXNz
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Downloads MZ/PE file
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy