Malicious
VB5/6 Executable
MD5: 37860380e5502267a0123b4c72d3c2ef
Size: 466.94 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 456 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d
- MD5
- 37860380e5502267a0123b4c72d3c2ef
- Verdict
- Malicious
- File type
- VB5/6 Executable · 456 KB
- Family
- DarkCloud Stealer
- Category
- Stealer
- C2 (defanged)
mail[.]mokasco[.]com
Cite this report: https://app.malva.re/sha256/ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d
Related DarkCloud Stealer samples
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876 2026-09-10
- 367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
466.94 KB · 466,944 B
First seen
2026-10-19 08:15 · 6 days ago
Last seen
2026-10-19 08:15 · 6 days ago
Last analysis
2026-10-26 02:31 · an hour ago
Hashes
MD5
37860380e5502267a0123b4c72d3c2ef
Sha1
2a56bdd0ca4b6a9843e1faedf5301fb8eeae90af
Sha256
ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d
Sha384
4fb6bf368de515b7010ad19499357de4e0e0a94fffc8742d203b4921615bd24874ae08ff4502b104f1591d4322778dcb
Sha512
a0db0ef0b7685ce33bafc4a1f22ece9e8db1d94563ff48ab941efa26aeddb36c2fc2327919912028f19a393882670cb68a2cfd84b22f7ccdc25c5201d756ff00
SSDeep
6144:tX8d1/w5KA81IJ8GpF6nuTmOOUiBUrjej05e8ndvGt7qhtdeqHxVybdX1t/+CWyV:tsjYKkJj6GmZUiqryjEHGy/RVybdFM
TLSH
2DA43A03AA50A12EF1A3C9F1ACB5A29628267D39179CE89BF3405F5935315D3ACF131F
Detection
PeID
Free Pascal v0.99.10MASM/TASM - sig4 (h)Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS
1 malicious · 17 files
EXE37860380e5502267a0123b4c72d3c2efDarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINResources
BINDarkCloud
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| Version | 4huhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | Adam.bhuhuhuhuhuhuhu |
| SMTP.Sender | Adam.bhuhuhuhuhuhuhu |
| SMTP.Password | Qz9fhuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |
DarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username
EMAILmalicious
Adam.bhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential