MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SentinelStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a
SHA3-384 hash: 36a2bfeb6de41c989055fc627bc9dfd17f21012505cc2b91eb8b58a2323c8946424bb2f730c9941d4d8036b2934df018
SHA1 hash: 227e4a32b618932524dcb38e5fb4c46669f072fc
MD5 hash: cc760cf91b4782b954c79e03d2edeb15
humanhash: happy-edward-utah-chicken
File name:Provent_720_SALES-Promotion_kt3uzd.rtf.vbs
Download: download sample
Signature SentinelStealer
Create hunting rule
File size:1'064'595 bytes
First seen:2026-04-14 06:54:15 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 24576:SLzT5N5ZKiJYimlHtw2hLX+V8nrTSawCAXjHlhY2ZvZcMF2:M5NpJYdrJqa+jHE
TLSH T1B935233719262D7E1D241DCAA01E1D1D6F902DDB9025ECC8F9C2E8AB563CE432BE2579
Magika vba
Reporter abuse_ch
Tags:SentinelStealer vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61476/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30450.JsHeur.ExeObj.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26270.JsHeur.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69dde4af45787c53e5397dad
Tags:
emotet lien
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 dropper evasive masquerade obfuscated obfuscated packed
Link:
https://www.filescan.io/uploads/69dde4aa9124ebc08751bca3/reports/a90be6d6-9135-4a32-bf89-a70339555707/overview
Verdict:
Malicious
Labled as:
GT:VB.AgentTesla.4
Link:
https://www.hybrid-analysis.com/sample/accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a
Verdict:
Malicious
File Type:
vbs
First seen:
2026-04-14T03:12:00Z UTC
Last seen:
2026-04-16T00:45:00Z UTC
Hits:
~100
Detections:
Trojan-Dropper.JS.SDrop.sb PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.JS.Cryptoload.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.Win32.Agent.sb Trojan-Banker.Win32.Javali.sb Trojan-PSW.MSIL.Stealer.sb HEUR:Trojan.Script.Generic HEUR:Trojan-PSW.MSIL.Coins.gen HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan-Banker.Win32.Javali.gen
Link:
https://opentip.kaspersky.com/accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a/results?tab=lookup
Result
Threat name:
SentinelStealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1897849
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected SentinelStealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1897849 Sample: Provent_720_SALES-Promotion... Startdate: 14/04/2026 Architecture: WINDOWS Score: 100 35 c3lestial.fun 2->35 37 ip-api.com 2->37 47 Suricata IDS alerts for network traffic 2->47 49 Antivirus detection for URL or domain 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 4 other signatures 2->53 9 wscript.exe 2 2->9         started        signatures3 process4 file5 27 C:\Users\user\AppData\Local\...\rad85CA2.exe, PE32 9->27 dropped 55 Benign windows process drops PE files 9->55 57 VBScript performs obfuscated calls to suspicious functions 9->57 59 Deletes itself after installation 9->59 61 2 other signatures 9->61 13 rad85CA2.exe 3 9->13         started        signatures6 process7 file8 29 C:\Users\user\AppData\...\svD6E5.tmp.exe, PE32+ 13->29 dropped 63 Antivirus detection for dropped file 13->63 65 Multi AV Scanner detection for dropped file 13->65 17 svD6E5.tmp.exe 14 3 13->17         started        21 cmd.exe 1 13->21         started        signatures9 process10 dnsIp11 31 c3lestial.fun 82.29.191.61, 443, 49701 NTLGB United Kingdom 17->31 33 ip-api.com 208.95.112.1, 49700, 80 TUT-ASUS United States 17->33 39 Multi AV Scanner detection for dropped file 17->39 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->41 43 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->43 45 11 other signatures 17->45 23 chrome.exe 17->23         started        25 conhost.exe 21->25         started        signatures12 process13
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a/
Verdict:
Malicious
Threat:
Family.SENTINEL_STEALER
Link:
https://tip.neiki.dev/file/accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-04-14 06:55:35 UTC
File Type:
Text (VBS)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtgqnv72r4s3tgu7np6zxyxrehec6xm2n2yzrdugkoc6gaansifa._file
Result
Malware family:
sentinel_stealer
Create hunting rule
Score:
  10/10
Tags:
family:sentinel_stealer collection credential_access discovery spyware stealer
Link:
https://tria.ge/reports/260414-hpglxagy6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Deletes itself
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects SentinelStealer in memory
Family: SentinelStealer
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61476/

Comments