renamer | 512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c | Triage

Submit
Reports

Overview

overview

Static

static

512565a199...7c.exe

windows7-x64

512565a199...7c.exe

windows10-2004-x64

Sharing

General

Target

512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c
Size

824KB
Sample

250216-29m4zaskdk
MD5

6edb0d66443e29ee4dddd8037f92023b
SHA1

095d79e04ca9d1e586087420c6995eb07cb21850
SHA256

512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c
SHA512

27c5f8e184c98530f2c583ea08316a7189c78295d4dab56c7b799d91f7d0f452a1dda387af77bc3e452c8e09e7ab449f414edb3acef8ee41a025e299fdaba4f0
SSDEEP

12288:ywCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEV888888888888W8888888J:iNzCtUpQ9WWPBSSRMTEpXNN

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c.exe

Resource

win7-20241010-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c.exe

Resource

win10v2004-20250211-en

renamer discovery worm

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c
- Size
  
  824KB
- MD5
  
  6edb0d66443e29ee4dddd8037f92023b
- SHA1
  
  095d79e04ca9d1e586087420c6995eb07cb21850
- SHA256
  
  512565a1996b0d3b91ae601fba97d63453b90d1e39f09febe9ffb92121c33c7c
- SHA512
  
  27c5f8e184c98530f2c583ea08316a7189c78295d4dab56c7b799d91f7d0f452a1dda387af77bc3e452c8e09e7ab449f414edb3acef8ee41a025e299fdaba4f0
- SSDEEP
  
  12288:ywCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEV888888888888W8888888J:iNzCtUpQ9WWPBSSRMTEpXNN
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Downloads MZ/PE file
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy