MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c275b9171e637565b8d0b7a8fccde14354bc3f9624472bf676dd5ab6a03bdd00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CNBackdoor

Vendor detections: 6

Intelligence 6 IOCs YARA 9 File information Comments

SHA256 hash:	c275b9171e637565b8d0b7a8fccde14354bc3f9624472bf676dd5ab6a03bdd00
SHA3-384 hash:	ca27e1e30233bc8b9b4a8014baeed7da76c2d3570b9facc548100ec1d43f7e0a58b7584bd493d0e8aa638663c7b23523
SHA1 hash:	5926997f518aebd7408e72a2de133ec008e32945
MD5 hash:	f25fae437365b7dce866bd9e4b872d4b
humanhash:	lactose-two-zulu-alabama
File name:	Installer.iso
Download:	download sample
Signature	CNBackdoor Create hunting rule
File size:	16'365'568 bytes
First seen:	2026-09-12 13:49:11 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:+L1JUhbnSiSgKoxf+5VRLS2AXbojrEygJmlUdtnc4haGFgrP:+pJUYiqGG5PS7X6rHmml14hjyr
TLSH	T10CF633F92AF96019DCDC2530121184AB42155277FF335A39F42B5F31AAE22B3FB49672
TrID	88.7% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika	iso
Reporter	aachum
Tags:	CNBackdoor iso

iamaachum

https://dl89sfilesbase.top/downloads/K3sBmaikZ/Packed

CNBackdoor C2: https://tommysbakescodes.ws/mnlinmwv/isnirs.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	763 bytes
SHA256 hash:	80121a6691663605f770bfa952d507321253851b2ed59fd201f65da43afd477a
MD5 hash:	d2e612daa9baf077beeb787009849bf9
MIME type:	text/plain
Signature	CNBackdoor

File name:	InstallerV10131x64_.exe
File size:	16'310'784 bytes
SHA256 hash:	d20de1e6ace9860426adff0d63fd8f84e3b5aff6bf2bc29dd2fe68178938d149
MD5 hash:	b63c7bff23cbbde6c98971012fe4202a
MIME type:	application/x-dosexec
Signature	CNBackdoor

Vendor Threat Intelligence

Gathering data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6aa5589fa03f521ebc7ef267/reports/79459f69-76df-4076-a6b2-67f442023f1a/overview

Verdict:

Malicious

Labled as:

W64/Themida.DH.gen

Link:

https://www.hybrid-analysis.com/sample/c275b9171e637565b8d0b7a8fccde14354bc3f9624472bf676dd5ab6a03bdd00

Verdict:

Malicious

File Type:

iso

First seen:

2026-09-12T12:50:00Z UTC

Last seen:

2026-09-12T14:51:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c275b9171e637565b8d0b7a8fccde14354bc3f9624472bf676dd5ab6a03bdd00/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable ISO9660 Image PE (Portable Executable) PE File Layout

Link:

https://app.malva.re/file/f25fae437365b7dce866bd9e4b872d4b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c275b9171e637565b8d0b7a8fccde14354bc3f9624472bf676dd5ab6a03bdd00/

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-09-12 13:50:33 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yj23sfy6mn2wlogqw6upztpbinklyp4werdsx5tw3vnlnib33uaa._file

Gathering data

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c275b9171e637565b8d0b7a8fccde14354bc3f9624472bf676dd5ab6a03bdd00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)