renamer | 847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a | Triage

Submit
Reports

Overview

overview

Static

static

847952e640...7a.exe

windows7-x64

847952e640...7a.exe

windows10-2004-x64

Sharing

General

Target

847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a
Size

824KB
Sample

250311-cnr4csxjv9
MD5

355bc90f73dcdf6ad8ad25115edeb369
SHA1

af604e42f51120fca852e8e925915bef71d1360f
SHA256

847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a
SHA512

0d271c6f746e1d35a7465195b39a173a8251913ac4a824521de14f0f651c8cda511e7f73b1c6aa40fe83c7373c30231b6283a5b5767eef132e62e38b4cdb6a06
SSDEEP

12288:UwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEH888888888888W8888888J:kNzCtUpQ9WWPBSSRMTEpXNz

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a.exe

Resource

win7-20240729-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a.exe

Resource

win10v2004-20250217-en

renamer discovery worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a
- Size
  
  824KB
- MD5
  
  355bc90f73dcdf6ad8ad25115edeb369
- SHA1
  
  af604e42f51120fca852e8e925915bef71d1360f
- SHA256
  
  847952e640685c4caaa534f61626c0e39575a4b399447b36831effaa197e8d7a
- SHA512
  
  0d271c6f746e1d35a7465195b39a173a8251913ac4a824521de14f0f651c8cda511e7f73b1c6aa40fe83c7373c30231b6283a5b5767eef132e62e38b4cdb6a06
- SSDEEP
  
  12288:UwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEH888888888888W8888888J:kNzCtUpQ9WWPBSSRMTEpXNz
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy