MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c
SHA3-384 hash:	3adaeb27d6246e09bb0f34ec1084c3d4b0b489072336c6b0144e335dbf77f155547bb64570c92369678037b90ea908bd
SHA1 hash:	1ff7424f6f1031f9d9ad75c413e306ea08e9bb9a
MD5 hash:	e4165d7a7d9743252bceec56bc842aea
humanhash:	leopard-king-pip-delta
File name:	CONTRACTXPLAN.rar
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	7'415 bytes
First seen:	2026-06-06 18:44:09 UTC
Last seen:	2026-06-08 15:01:55 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	192:OUDgVpJm6r/XXowl/Xq8pSUyui6TprZHJXPmpbAy/DkfSUA:OUDg1nr/XYePDQDRSrCmfSUA
TLSH	T11FE19E1CA5A8B6277E4487DA6986E8FD728C0DA120EC3C6A50E759E205002DCF371FDE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	PhantomStealer rar

Intelligence

---

File Origin

# of uploads :

17

# of downloads :

57

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	CONTRACT PLAN.js
File size:	73'341 bytes
SHA256 hash:	2b65cc65e88bef859ffc216258c8afc3e08b80f3efc607fd5168902a4295c5ea
MD5 hash:	f045f6b367a478fa665cefe2f19a606a
MIME type:	text/plain
Signature	PhantomStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/fb9596e6-f7ad-4071-b4c5-c0fa0a4835a5/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Other.Malware-gen.17814814.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2149e157b7bf261d60c9db

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint repaired

Link:

https://www.filescan.io/uploads/6a246a884bb6e36d180c8ece/reports/0e3b2ca6-bdbb-4b46-9b11-4b6d26124f2d/overview

Hybrid Analysis Trojan.GenericS

Verdict:

Malicious

Labled as:

Trojan.GenericS

Link:

https://www.hybrid-analysis.com/sample/00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-04T13:58:00Z UTC

Last seen:

2026-06-04T14:10:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c/

ReversingLabs TitaniumCloud Win32.Trojan.Znyonm

Threat name:

Win32.Trojan.Znyonm

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-04 10:12:25 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

17 of 38 (44.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ac33wdje4zwnoeooxxlnctns5bq65e3yhyd3aqvumugego3kye6a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c