renamer | 754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515e | Triage

Submit
Reports

Overview

overview

Static

static

754161c625...eN.exe

windows7-x64

754161c625...eN.exe

windows10-2004-x64

Sharing

General

Target

754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515eN.exe
Size

824KB
Sample

250216-c6ldjayld1
MD5

fc675a167ab8f2283a81b0a495cc3780
SHA1

c275ee772653d25c3712bdb15ad4379e9a23ca3c
SHA256

754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515e
SHA512

1744c92c9100ddbed78fad76ed46a06e37dcf8a5cf090a16ba11fda79e3f6ea42fb39c01a0926752eaad2d7cc445b31013e203aaa2604cf9dba5a3dcb215c222
SSDEEP

12288:pwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEc888888888888W8888888J:dNzCtUpQ9WWPBSSRMTEpXNu

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515eN.exe

Resource

win7-20241010-en

renamer discovery worm

windows7-x64

10 signatures

120 seconds

Behavioral task

behavioral2

Sample

754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515eN.exe

Resource

win10v2004-20250211-en

renamer discovery worm

windows10-2004-x64

11 signatures

120 seconds

Malware Config

Targets

- Target
  
  754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515eN.exe
- Size
  
  824KB
- MD5
  
  fc675a167ab8f2283a81b0a495cc3780
- SHA1
  
  c275ee772653d25c3712bdb15ad4379e9a23ca3c
- SHA256
  
  754161c6251640b659a1dffa0f2a2971623a2a18e720ec56ae65d13f8d60515e
- SHA512
  
  1744c92c9100ddbed78fad76ed46a06e37dcf8a5cf090a16ba11fda79e3f6ea42fb39c01a0926752eaad2d7cc445b31013e203aaa2604cf9dba5a3dcb215c222
- SSDEEP
  
  12288:pwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEc888888888888W8888888J:dNzCtUpQ9WWPBSSRMTEpXNu
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Downloads MZ/PE file
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy