MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98dc1ee834d166396ed8c20ec28f8defd7e8b127b5da6787dba6cba1abfb6f06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 8 File information Comments

SHA256 hash:	98dc1ee834d166396ed8c20ec28f8defd7e8b127b5da6787dba6cba1abfb6f06
SHA3-384 hash:	a6bcdf423469b574f78268a53d5b869fe2680b05e1fff0e9123d7ff79193fc5f59d444011af2421d678a1291138efaa8
SHA1 hash:	ea19cdf910111d22d00a2c63f08f86d21e8ba680
MD5 hash:	96f77ac6a1428e4166309756565fdc38
humanhash:	arizona-golf-chicken-cup
File name:	Installer.iso
Download:	download sample
File size:	15'321'088 bytes
First seen:	2026-08-23 00:35:23 UTC
Last seen:	2026-08-24 12:00:04 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:DzkEpVEVnmLlUj3QffMwvkqhE2fZXi/LLlUdSK5Eci8i3j:DzhQVnmLCjA8cthE2fZXi/E5vi8i
TLSH	T133F633B03E2008A1DD7C18B6C09F57B617BEC79D628162121F5E313C967E43E9AE7B64
TrID	88.7% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika	iso
Reporter	aachum
Tags:	CNBackdoor iso

iamaachum

https://dl89sfilesbase.top/downloads/K2n7RfyB/Packed

CNBackdoor C2:
https://tommysbakescodes.ws/mnlinmwv/insris.php
https://tabbysbakescodes.ws/mnlinmwv/insirs.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	InstallerV29171x64_.exe
File size:	15'266'816 bytes
SHA256 hash:	7a3d2c381a1f24002794f1bf5e7c7a2c73507a04a3741c40f6b7790983892e53
MD5 hash:	8c035d3a590ef1300c25a4069d634a45
MIME type:	application/x-dosexec

File name:	ReadMe.txt
File size:	763 bytes
SHA256 hash:	80121a6691663605f770bfa952d507321253851b2ed59fd201f65da43afd477a
MD5 hash:	d2e612daa9baf077beeb787009849bf9
MIME type:	text/plain

Vendor Threat Intelligence

Malware configuration found for:

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1c9c12d8-097f-486c-ac52-a96e2c50aeb2/

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/98dc1ee834d166396ed8c20ec28f8defd7e8b127b5da6787dba6cba1abfb6f06

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable ISO9660 Image PE (Portable Executable) PE File Layout

Link:

https://app.malva.re/file/96f77ac6a1428e4166309756565fdc38

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/98dc1ee834d166396ed8c20ec28f8defd7e8b127b5da6787dba6cba1abfb6f06/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tdob52bu2ftds3wyyihmfd4n57l6rmjhwxngpb63u3f2dk73n4da._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/98dc1ee834d166396ed8c20ec28f8defd7e8b127b5da6787dba6cba1abfb6f06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)