Overview

overview

10

Static

static

3

7bee7fc9f2...25.exe

windows7-x64

10

7bee7fc9f2...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7bee7fc9f2794f0bfe82f5cac76b3a34b1aac5dcbc26ad8f3a90c442bf5b6525

  • Size

    924KB

  • Sample

    250314-ee6lhassfs

  • MD5

    4de812278bfdd2a103c11cb160ee2078

  • SHA1

    d01a1a80e4fe0096530e9551225ede0106e2f70c

  • SHA256

    7bee7fc9f2794f0bfe82f5cac76b3a34b1aac5dcbc26ad8f3a90c442bf5b6525

  • SHA512

    d9b6821b8db9e43e68ed10524b8c50b3364b9e0c9d386218ab6281a0f5e464af997d79df9f1c2505f5c0b69c4c8f192b69b27b66f4e93d4293c18ba9c83c6861

  • SSDEEP

    12288:Wytm2WSk/SSs/O0OOlkmJ5pIJYgEl2yjreZiOt+nW2wk/D3U:9tmdiEOlk26aVeZiOmW2pU

Score
10/10
renamerdiscoveryworm

Malware Config

Targets

    • Target

      7bee7fc9f2794f0bfe82f5cac76b3a34b1aac5dcbc26ad8f3a90c442bf5b6525

    • Size

      924KB

    • MD5

      4de812278bfdd2a103c11cb160ee2078

    • SHA1

      d01a1a80e4fe0096530e9551225ede0106e2f70c

    • SHA256

      7bee7fc9f2794f0bfe82f5cac76b3a34b1aac5dcbc26ad8f3a90c442bf5b6525

    • SHA512

      d9b6821b8db9e43e68ed10524b8c50b3364b9e0c9d386218ab6281a0f5e464af997d79df9f1c2505f5c0b69c4c8f192b69b27b66f4e93d4293c18ba9c83c6861

    • SSDEEP

      12288:Wytm2WSk/SSs/O0OOlkmJ5pIJYgEl2yjreZiOt+nW2wk/D3U:9tmdiEOlk26aVeZiOmW2pU

    Score
    10/10
    renamerdiscoveryworm

    • Detects Renamer worm.

      Renamer aka Grename is worm written in Delphi.

    • Renamer family

      renamer

    • Renamer, Grenam

      Renamer aka Grenam is a worm written in Delphi.

      wormrenamer

    • Drops startup file

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks