Malicious
VB5/6 Executable
MD5: 4c3db6aedc2f340a501cfaad1e10751a
Size: 471.04 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 460 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e
- MD5
- 4c3db6aedc2f340a501cfaad1e10751a
- Verdict
- Malicious
- File type
- VB5/6 Executable · 460 KB
- Family
- DarkCloud Stealer
- Category
- Stealer
- C2 (defanged)
mail[.]mokasco[.]com
Cite this report: https://app.malva.re/sha256/367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e
Related DarkCloud Stealer samples
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3 2026-10-19
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
471.04 KB · 471,040 B
First seen
2026-09-10 11:01 · one month ago
Last seen
2026-09-10 11:01 · one month ago
Last analysis
2026-10-26 02:34 · 39 minutes ago
Hashes
MD5
4c3db6aedc2f340a501cfaad1e10751a
Sha1
aab0b80610f8fa94b86399dc8e75ad559e8ab20a
Sha256
367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e
Sha384
123ec8389eb13df3db16304bf8c520b734cda7afa2064ba4340f7508a011eeaf67b05a9a55a9fc9fb2cac4a05af15ede
Sha512
b9c5e7f6d285e4f0a8905da344d962c291fe7587956ef18f0ccdb63f409ab168b8e81e5f18bf6ad162ec4af9f0f8b836b735c63dd6921d24a89db15548b1598e
SSDeep
6144:78d1/w5KA81IJ8GpF6nuTmOOUiBUrjHvmJ1AAZ/3G7qh0zHniPnyP4f+ZOGyCW7D:AjYKkJj6GmZUiqrzud/3UHInyP4fin
TLSH
E8A43A03AA50A12EF1A3C9F1A8B5A29628267D3917DCE89BF3404F5935715D3ACF131F
Detection
PeID
Free Pascal v0.99.10MASM/TASM - sig4 (h)Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS
1 malicious · 17 files
EXE4c3db6aedc2f340a501cfaad1e10751aDarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINDarkCloud
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| Version | 4huhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | Adam.bhuhuhuhuhuhuhu |
| SMTP.Sender | Adam.bhuhuhuhuhuhuhu |
| SMTP.Password | Qz9fhuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |
DarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username
EMAILmalicious
Adam.bhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential