Beware! Grenam Malware Masquerades as MS Paint

malware

Grenam is the name of one part of a family of malicious files that has been identified by Microsoft's security researchers.

The threat should be picked up by the instance of Microsoft Defender that you have running on your computer. Defender identifies the threat as Win32/Grenam.

Grenam is part of a family consisting of three separate components. One is a Trojan that helps the malware achieve persistence through autorun on system boot. The other component has wormlike capabilities and helps the malware propagate through removable devices. The final component is virus-like and renames executable files.

Once it deploys on the system, Grenam will make a copy of itself and place it under %APPDATA%\paint.exe. A shortcut to this executable is placed inside the startup system folder, ensuring persistence and making the executable run on system boot.

Some instances also add a new registry entry to establish persistence, under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

The wormlike component will create copies of the same executable, naming it paint.exe and dropping it on any removable drive found on the system.

The virus will rename files on your system, appending the letter "v" in front of them.

Why You Should Safely Detect & Remove The Virus:Win32/Grenam.A Trojan Horse Malware

August 25, 2022
Loading...

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.