{"id":1371,"date":"2024-01-21T05:59:16","date_gmt":"2024-01-21T05:59:16","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1371"},"modified":"2024-04-22T12:51:33","modified_gmt":"2024-04-22T12:51:33","slug":"worm-win32-renamer","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2024\/01\/21\/worm-win32-renamer\/","title":{"rendered":"Worm.Win32.Renamer"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Worm
\nDestruction Level:<\/strong> Moderate
\nPrevalence:<\/strong> High<\/p>\n

<\/h2>\n

Malware Name(s)<\/h3>\n
    \n
  • Worm.Win32.Renamer (Padvish)<\/li>\n
  • Virus:Win32\/Grenam.B (Microsoft )<\/li>\n
  • Win32\/AutoRun.Delf.LV (ESET-NOD32)<\/li>\n<\/ul>\n

    <\/h3>\n

    What is a worm?<\/h3>\n

    A worm is a type of malware characterized by its ability to self-replicate and spread within computer systems. Worms, like the Renamer malware, establish mechanisms for persistence, ensuring they remain active during each system boot. These malicious programs often spread through portable drives and shared directories within a network.<\/p>\n

    <\/h3>\n

    What is the Renamer malware?<\/h3>\n

    The Renamer<\/em> malware, in particular, operates by generating its own files with deceptive names, closely resembling those of legitimate system files. After some alterations, the malware disguises itself among clean files, allowing it to execute alongside genuine components without raising immediate suspicion.<\/p>\n

    <\/h3>\n

    Technical Review<\/h2>\n

    Indicators of Compromise (IoC)<\/h3>\n
      \n
    1. Adding a prefix (randomly) to the beginning of clean file names (in new versions letter (v<\/strong>) and in old versions letter (g<\/strong>)) and hiding them from the user<\/li>\n
    2. Existance of the paint.exe<\/em><\/span> file, in the path Users%\\AppData\\Roaming\\Paint.exe%<\/em><\/span> (in the old version of Ground.exe<\/em><\/span>)<\/li>\n
    3. Existence of the file systemroot%\\paint%<\/em><\/span><\/li>\n
    4. Existence of Paint.lnk<\/em><\/span> file to guarantee survival:
      \n%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Paint.lnk<\/em><\/span>
      \nTarget: %AppData%\\Paint.exe<\/em><\/span><\/li>\n<\/ol>\n

      <\/h2>\n

      Malware Intent<\/h3>\n

      One of the goals of this malware is to occupy hard disk space and overuse CPU.<\/p>\n

       <\/p>\n

      Performance Description<\/h3>\n

      \u2714\ufe0f\u00a0Malware adds a random prefix (letter “v<\/span><\/strong>” in this version of the file ) to the beginning of the names of clean and system files in the following paths. Then it hides them and creates its own files with fake names, similar to the names of those files. In that way, the malware copies itself into folders.
      \n%systemroot%:\\*.exe<\/span><\/em>
      \n%systemroot%:\\ProgramFiles\\\u2026\\*.exe<\/span><\/em>
      \n:%Users%\\Desktop\\*.exe<\/span><\/em><\/p>\n

      \u2714\ufe0f The system user runs the malware assuming the file is clean, but without realizing that first the malware and then the clean file is running. An example of how the malware works, can be seen in the following image:<\/p>\n

      Malware file:<\/strong> C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe<\/em><\/span><\/p>\n

      Clean file :<\/strong> C:\\Program Files\\Google\\Chrome\\Application\\v<\/span>chrome.exe<\/em><\/span><\/p>\n

      \"\"<\/p>\n

      \u2714\ufe0f\u00a0The malware places an autorun file with the following contents on all system drives (%systemroot%: autorun.inf)<\/em> :<\/p>\n

      \"\u0641\u0627\u06cc\u0644\u2714\ufe0f\u00a0Then, for Survival, the Malware creates a shortcut that points to the original malware file:<\/p>\n

      %Users%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Paint.lnk<\/span><\/em>
      \nTarget: %Users%\\AppData\\Roaming\\Paint.exe”<\/span><\/em><\/p>\n

      \"Shortcut<\/p>\n

      <\/h3>\n

      How to deal with and clean the system?<\/strong><\/h2>\n

      \u2714\ufe0f\u00a0By employing UMP<\/em> technology as a part of its behavior-based protection, Padvish antivirus prevents the system from becoming infected through portable drives.
      \nSo, it is recommended to install Padvish antivirus to prevent malware infections (such as Renamer<\/em>) that are transferred through portable drives.<\/p>\n

       <\/p>\n","protected":false},"excerpt":{"rendered":"

      Overview Type: Worm Destruction Level: Moderate Prevalence: High Malware Name(s) Worm.Win32.Renamer (Padvish) Virus:Win32\/Grenam.B (Microsoft ) Win32\/AutoRun.Delf.LV (ESET-NOD32) What is a worm? A worm is a type of malware characterized by its ability to self-replicate and spread within computer systems. Worms, like the Renamer malware, establish mechanisms for persistence, ensuring they remain active during each system…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1371","post","type-post","status-publish","format-standard","hentry","category-worm"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1371"}],"version-history":[{"count":15,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1371\/revisions"}],"predecessor-version":[{"id":1553,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1371\/revisions\/1553"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}