renamer | d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6 | Triage

Submit
Reports

Overview

overview

Static

static

d00116c7f3...6N.exe

windows7-x64

d00116c7f3...6N.exe

windows10-2004-x64

Sharing

General

Target

d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6N.exe
Size

827KB
Sample

250224-kstfzstlam
MD5

729a85575ac03b61b2402fa16710cb70
SHA1

a9662ca4a7c2a31fa68ee4a139a4b9cac2e9cfde
SHA256

d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6
SHA512

9d9fd5d737d23d563d57d23d1903af99179ce0efe5a5fff4f00deb16175a9875a440423204f04286dd14181baafc7587fca8bb7e926410751092b877f984a234
SSDEEP

12288:xwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEm888888888888W8888888B:1NzCtUpQ9WWPBSSRMTEpXNM

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6N.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

10 signatures

120 seconds

Behavioral task

behavioral2

Sample

d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6N.exe

Resource

win10v2004-20250217-en

renamer discovery worm

windows10-2004-x64

9 signatures

120 seconds

Malware Config

Targets

- Target
  
  d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6N.exe
- Size
  
  827KB
- MD5
  
  729a85575ac03b61b2402fa16710cb70
- SHA1
  
  a9662ca4a7c2a31fa68ee4a139a4b9cac2e9cfde
- SHA256
  
  d00116c7f35fe15964f3c7d11efe08cfb1131e864127c15619bfdb2376a760c6
- SHA512
  
  9d9fd5d737d23d563d57d23d1903af99179ce0efe5a5fff4f00deb16175a9875a440423204f04286dd14181baafc7587fca8bb7e926410751092b877f984a234
- SSDEEP
  
  12288:xwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEm888888888888W8888888B:1NzCtUpQ9WWPBSSRMTEpXNM
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.