MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CNBackdoor

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711
SHA3-384 hash:	9647e70003c95b66758f925295c9e90e41aeca9e1081cd114303e2c47e85f41bf8ef6eb43d91cf12866eca2dd29466fb
SHA1 hash:	aa64e137c6d4de7efec5deeec45f78efcd79e92f
MD5 hash:	b5de2a03c256cbe4b89e8b4ea0da8df7
humanhash:	neptune-freddie-charlie-nebraska
File name:	Installer.iso
Download:	download sample
Signature	CNBackdoor Create hunting rule
File size:	16'969'728 bytes
First seen:	2026-10-07 02:59:26 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:GpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:mRlesiNRseIpAV9h
TLSH	T1BB07337D3588042CE68CEE3B173BB58882EBBD362D389115F249F1BD5634AD152F1B29
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	aachum
Tags:	CNBackdoor iso

iamaachum

https://dl89sfilesbase.top/downloads/K3sR1bn0Z/Packed

CNBackdoor C2:
https://tommysbakescodes.ws/mnlinmwv/isnris.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	762 bytes
SHA256 hash:	ba885bffe7c128af7e66b5b0a7c954201dfc17ec79780bf1b450e3e3c5ff91e1
MD5 hash:	2eaf0d6712becf502d90f78b30e1d85e
MIME type:	text/plain
Signature	CNBackdoor

File name:	Installer21691x64.exe
File size:	16'915'456 bytes
SHA256 hash:	749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
MD5 hash:	770e477b5f8cd94a6783140a3bb62225
MIME type:	application/x-dosexec
Signature	CNBackdoor

Vendor Threat Intelligence

Malware configuration found for:

Details

Link:

https://research.acce.ciphertechsolutions.com/results/2b6296e7-b7a1-4a16-9774-b46fe02053ea/

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad022d6f4e17c78f7155002

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed packed themidawinlicense

Link:

https://www.filescan.io/uploads/6ac5b5daac12024c99a4342b/reports/2410b1d0-06f0-4659-a979-71a04f721278/overview

Verdict:

Suspicious

Labled as:

W64/Themida.DH.gen

Link:

https://www.hybrid-analysis.com/sample/29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711

Verdict:

Malicious

File Type:

iso

First seen:

2026-10-07T01:01:00Z UTC

Last seen:

2026-10-07T01:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable ISO9660 Image PE (Portable Executable) PE File Layout

Link:

https://app.malva.re/file/b5de2a03c256cbe4b89e8b4ea0da8df7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711/

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-10-07 03:00:54 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fgvvrv7pbd4yxjglbyqlbge6xbdayyshfa6fgdkbxso46z5j44iq._file

Result

Malware family:

cnbackdoor

Score:

10/10

Tags:

family:cnbackdoor backdoor defense_evasion discovery execution persistence privilege_escalation themida trojan

Link:

https://tria.ge/reports/261007-e54jtssse1/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Enumerates connected drives

Checks BIOS information in registry

Creates a file in the Startup directory

Executes a file named after a Windows system binary

Executes dropped EXE

Themida packer

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Family: CNBackdoor

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)