MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b73b3a4370699c8b2d629322f0a144086e7a214d1f0cb7a631f3965070de4e6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CNBackdoor

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	b73b3a4370699c8b2d629322f0a144086e7a214d1f0cb7a631f3965070de4e6d
SHA3-384 hash:	739cc0609735588d55672b5640632a9ccbc2ed30b1ad10fe5e383a99b5d1519e9727f342d7f7069f7fa394a8d7a57a0a
SHA1 hash:	75f84ba429432286c8a249c3c2a769a57aa231cf
MD5 hash:	2b60cf975a48f68b15dbf19d5672dadf
humanhash:	xray-twenty-lion-michigan
File name:	Installer.iso
Download:	download sample
Signature	CNBackdoor Create hunting rule
File size:	16'175'104 bytes
First seen:	2026-09-19 12:02:28 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:Fodl33zfLuUL7boI9IdDTHd5CvVheFP2er9o3qCFuxVg5Im:mdl33zflToIidDT8e5SmQW
TLSH	T16CF633753691C9E9ED00527B4B68F62553339F3204E68879F8BD7B56A3F0CC5C8329A2
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	aachum
Tags:	CNBackdoor iso

iamaachum

https://dl89sfilesbase.top/downloads/K3sBmaikZ/Packed

CNBackdoor C2:
https://tommysbakescodes.ws/mnlinmwv/isnris.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	763 bytes
SHA256 hash:	80121a6691663605f770bfa952d507321253851b2ed59fd201f65da43afd477a
MD5 hash:	d2e612daa9baf077beeb787009849bf9
MIME type:	text/plain
Signature	CNBackdoor

File name:	Installer157372X64.exe
File size:	16'121'856 bytes
SHA256 hash:	8175a605125bce3e2a31bba5ebd9211d88cb05d2fbd448474db9aac56fea63e0
MD5 hash:	af67a08210159092ce5162dd32a6e892
MIME type:	application/x-dosexec
Signature	CNBackdoor

Vendor Threat Intelligence

Malware configuration found for:

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a10ebaca-1fce-4232-916a-d950df38ff77/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.79179922.UNOFFICIAL

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/b73b3a4370699c8b2d629322f0a144086e7a214d1f0cb7a631f3965070de4e6d

Verdict:

Malicious

File Type:

iso

First seen:

2026-09-19T12:09:00Z UTC

Last seen:

2026-09-19T12:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b73b3a4370699c8b2d629322f0a144086e7a214d1f0cb7a631f3965070de4e6d/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable ISO9660 Image PE (Portable Executable) PE File Layout

Link:

https://app.malva.re/file/2b60cf975a48f68b15dbf19d5672dadf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b73b3a4370699c8b2d629322f0a144086e7a214d1f0cb7a631f3965070de4e6d/

Threat name:

Win32.Trojan.Kepavll

Status:

Malicious

First seen:

2026-09-19 12:03:22 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w45tuq3qngoiwllcsmrpbikebbxhuiknd4glpjrr6olfa4g6jzwq._file

Result

Malware family:

cnbackdoor

Score:

10/10

Tags:

family:cnbackdoor backdoor defense_evasion execution persistence privilege_escalation themida trojan

Link:

https://tria.ge/reports/260919-s7tz3atvfv/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

Drops file in Program Files directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Checks BIOS information in registry

Creates a file in the Startup directory

Executes dropped EXE

Themida packer

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Family: CNBackdoor

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b73b3a4370699c8b2d629322f0a144086e7a214d1f0cb7a631f3965070de4e6d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.