🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SentinelStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db
SHA3-384 hash: e2a3dd2a784fd234e3577639654d0a612961ef0c5d2e52b76180b90deed0ad1354211aa81d80a36b5a99d4a51b7b4143
SHA1 hash: b6c9df1977bddee6d2881207bb46f9f3749c1367
MD5 hash: e223241d1ab78d7e326d1bd8ea588eeb
humanhash: steak-freddie-virginia-whiskey
File name:Document_74mfwc.doc.vbs
Download: download sample
Signature SentinelStealer
Create hunting rule
File size:1'102'823 bytes
First seen:2026-04-17 14:17:10 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 24576:YSpkpFiPG5fhBMDtQz2/OwWvv2UIxwWTWWGKz9U+Q:wGSfxe98rd
TLSH T1E335233C7583BC5E3BBC9AEFA01636991D74AEE3E24CD4E1888CA48716DC6961C5DC34
Magika vba
Reporter abuse_ch
Tags:SentinelStealer vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61972/
Detection(s):
Sanesecurity.Malware.26270.JsHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30450.JsHeur.ExeObj.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69e240fb45787c53e53a9cb1
Tags:
emotet lien
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 dropper evasive masquerade obfuscated obfuscated packed
Link:
https://www.filescan.io/uploads/69e240f7c33dc5a985da982c/reports/dc343fb5-65f6-4295-baad-93ff020e067f/overview
Verdict:
Malicious
Labled as:
GT:VB.AgentTesla.4
Link:
https://www.hybrid-analysis.com/sample/653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db
Verdict:
Malicious
File Type:
vbs
First seen:
2026-04-16T12:32:00Z UTC
Last seen:
2026-04-19T10:02:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Win32.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan.Script.Generic HEUR:Trojan-PSW.Win32.Coins.gen HEUR:Trojan-Dropper.Script.Generic Trojan-Spy.Stealer.TCP.C&C Trojan-PSW.Win32.Coins.sb Trojan-PSW.Coins.TCP.C&C PDM:Trojan.Win32.Generic Trojan-PSW.MSIL.Stealer.sb HEUR:Trojan-PSW.MSIL.Coins.gen Trojan-Dropper.JS.SDrop.sb Trojan-Banker.Win32.Javali.sb
Link:
https://opentip.kaspersky.com/653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db/results?tab=lookup
Result
Threat name:
SentinelStealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1900176
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Cscript/Wscript Uncommon Script Extension Execution
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected SentinelStealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1900176 Sample: Document_74mfwc.doc.vbs Startdate: 17/04/2026 Architecture: WINDOWS Score: 100 37 c3lestial.fun 2->37 39 ip-api.com 2->39 49 Suricata IDS alerts for network traffic 2->49 51 Antivirus detection for URL or domain 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 5 other signatures 2->55 9 wscript.exe 2 2->9         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\rad43740.exe, PE32 9->29 dropped 57 Benign windows process drops PE files 9->57 59 VBScript performs obfuscated calls to suspicious functions 9->59 61 Deletes itself after installation 9->61 63 2 other signatures 9->63 13 rad43740.exe 4 9->13         started        signatures6 process7 file8 31 C:\Users\user\AppData\...\sv17FF.tmp.exe, PE32+ 13->31 dropped 65 Antivirus detection for dropped file 13->65 17 sv17FF.tmp.exe 14 3 13->17         started        21 cmd.exe 1 13->21         started        signatures9 process10 dnsIp11 33 c3lestial.fun 82.29.191.61, 443, 49720 NTLGB United Kingdom 17->33 35 ip-api.com 208.95.112.1, 49718, 80 TUT-ASUS United States 17->35 41 Multi AV Scanner detection for dropped file 17->41 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->43 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->45 47 11 other signatures 17->47 23 chrome.exe 17->23         started        25 conhost.exe 21->25         started        27 conhost.exe 21->27         started        signatures12 process13
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db/
Verdict:
Malicious
Threat:
Family.SENTINEL_STEALER
Link:
https://tip.neiki.dev/file/653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-04-17 01:05:57 UTC
File Type:
Text (VBS)
AV detection:
11 of 36 (30.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mu5zorzbgzxsf6zfvxrx4swwhuiipr6vwiezcx3ifdhiwfwz4lnq._file
Result
Malware family:
sentinel_stealer
Create hunting rule
Score:
  10/10
Tags:
family:sentinel_stealer collection credential_access discovery spyware stealer
Link:
https://tria.ge/reports/260417-rlx9xsby9v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Deletes itself
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects SentinelStealer in memory
Family: SentinelStealer
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61972/

Comments