MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34c7d56bc43c8aa3b4c9c9f42fe85081830480430498aac2b3eff9f8c236c14f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CNBackdoor

Vendor detections: 8

Intelligence 8 IOCs YARA 8 File information Comments

SHA256 hash:	34c7d56bc43c8aa3b4c9c9f42fe85081830480430498aac2b3eff9f8c236c14f
SHA3-384 hash:	159df69c79eda505b4600acbe2e80c6b89d293cfa53c36dfcbbd11d0bc69249eb2d76e3e51a372867b68b95fef955ca8
SHA1 hash:	b7ee7d8e5f9fe3120b4e5c7a17bda745deb23a2d
MD5 hash:	f6e2a59c37f4175a3fd546e4b2d4e658
humanhash:	nineteen-green-pizza-coffee
File name:	Installer.iso
Download:	download sample
Signature	CNBackdoor Create hunting rule
File size:	15'429'632 bytes
First seen:	2026-04-14 13:45:03 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:aNTVfxopTLCVyd/OYWan+Vpre09oQQIGJqumhycjk5dhHK1zbTn:atVfx2TLCVyd/OZpi02QvHjwnhq13
TLSH	T10CF63330E6190C7CD54E6576989AF0273E5AACA200DD31E5336E3EA34FFDCA6C548A17
TrID	88.7% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika	iso
Reporter	aachum
Tags:	CNBackdoor iso purecrypter tommysbakescodes-cv

iamaachum

https://dl89sfilesbase.top/downloads/As6hThcM/AppSetup

CNBackdoor C2:
https://tommysbakescodes.ws/mnlinmwv/insirs.php
tommysbakescodes.cv

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	760 bytes
SHA256 hash:	a2b18ffd6f199ad4b53b2475af68a64e771dcb1ee24d87abedb762f5980d0c42
MD5 hash:	e0f669790e02a7e490d865deb7f62905
MIME type:	text/plain
Signature	CNBackdoor

File name:	Installer_v2169_x64.exe
File size:	15'376'384 bytes
SHA256 hash:	4fa631a1f53f2a220595072e1d6bc5c963a70be5ff9fd7cf2c47245e6f7d715b
MD5 hash:	edada46a6b7bd4de2cca55abbb04844b
MIME type:	application/x-dosexec
Signature	CNBackdoor

Vendor Threat Intelligence

Malware configuration found for:

Details

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion execution persistence themida trojan

Link:

https://tria.ge/reports/260414-rbzp1acv3p/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/34c7d56bc43c8aa3b4c9c9f42fe85081830480430498aac2b3eff9f8c236c14f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)