Malicious
Malicious

8e430e4ba5cdcacfb6b5125755e6944a

VB5/6 Executable
MD5: 8e430e4ba5cdcacfb6b5125755e6944a
Size: 466.94 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 456 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61
MD5
8e430e4ba5cdcacfb6b5125755e6944a
Verdict
Malicious
File type
VB5/6 Executable · 456 KB
Family
DarkCloud Stealer
Category
Stealer
C2 (defanged)
mail[.]mokasco[.]com

Cite this report: https://app.malva.re/sha256/22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
466.94 KB · 466,944 B
First seen
2026-10-19 08:01 · 6 days ago
Last seen
2026-10-19 08:01 · 6 days ago
Last analysis
2026-10-26 02:40 · an hour ago
Hashes
MD5 8e430e4ba5cdcacfb6b5125755e6944a Sha1 0cc7902022f0dcc7a44d0595a16db15c059f0d36 Sha256 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 Sha384 2b2246d02d9b6d4fa646c5202174676aa4150efb72ea03fb230bcf9de5e7851404bea03a2474186189609bc69ac16d54 Sha512 95da8d41df325ceb3741d4261b53d30025771e8911f3195566b32f0c7055ed33aea18b9e259e21abfc278606e1f00ceb2bdaebb99010f39e493fe05ac573ecd4 SSDeep 6144:z8d1/w5KA81IJ8GpF6nuTmOOUiBUrj/7wbFKuqtIK7qhYOW026Uy0omt0snCCWIm:YjYKkJj6GmZUiqrr7+KIZdVUy0omCX TLSH E1A43A03AA60A12EF1A3C9F1ACB5629628267D39179CE89BF3405F5935315D3ACF131F
Detection
PeID
Free Pascal v0.99.10MASM/TASM - sig4 (h)Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS

1 malicious · 17 files
EXE8e430e4ba5cdcacfb6b5125755e6944aDarkCloud Stealer
Structure
BINVB6
BINDecompilation
BIN[VB6 project]
TXTProject1.vbp
FRMForm1.frm
FRXForm1.frx
BASModule1.bas
BASModule2.bas
BASModule3.bas
BASModule5.bas
BASModule7.bas
BASVBRF_Types.bas
BASVBRF_Inconnu.bas
TXTEXPORT-NOTES.txt
BINResources
BINRT_ICON
BINID:7531
BINID:0
BINID:7532
BINID:0
BINID:7533
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:1033
BINDarkCloud
BINConfiguration
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
Extraction method VBReFohuhuhuhuhuhuhuhuhuhuhu
Exfiltration configuration complete Thuhuhuhu
Version 4huhuhuhu
StagingDirectory %AppDahuhuhuhuhuhuhuhuhuhuhu
FTP.Enabled Fhuhuhuhu
FTP.Server [builder placeholder] @Strhuhuhuhuhuhuhu
FTP.Username [builder placeholder] @Sthuhuhuhu
FTP.Password [builder placeholder] @Sthuhuhuhu
SMTP.Enabled Thuhuhuhu
SMTP.Recipient e.bauthuhuhuhuhuhuhu
SMTP.Server mail.huhuhuhuhuhuhu
SMTP.Username Adam.bhuhuhuhuhuhuhu
SMTP.Sender Adam.bhuhuhuhuhuhuhu
SMTP.Password Qz9fhuhuhuhu
SMTP.Port 5huhuhuhu
SMTP.UseSsl fhuhuhuhu
SMTP.Authentication 1huhuhuhu
HTTP.Enabled Fhuhuhuhu
HTTP.GateUrl [builder placeholder] @Ghuhuhuhu
Telegram.Enabled Fhuhuhuhu
Telegram.BotToken [builder placeholder] @Strhuhuhuhu
Telegram.ChatId [builder placeholder] @Chuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
VB6 decompilation
VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native).
DarkCloud extraction
VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation.

DarkCloud SMTP.Recipient EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username EMAILmalicious
Adam.bhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 17 files
EXE8e430e4ba5cdcacfb6b5125755e6944aDarkCloud Stealer
Structure

Config. Field Value
Extraction method VBReFohuhuhuhuhuhuhuhuhuhuhu
Exfiltration configuration complete Thuhuhuhu
Version 4huhuhuhu
StagingDirectory %AppDahuhuhuhuhuhuhuhuhuhuhu
FTP.Enabled Fhuhuhuhu
FTP.Server [builder placeholder] @Strhuhuhuhuhuhuhu
FTP.Username [builder placeholder] @Sthuhuhuhu
FTP.Password [builder placeholder] @Sthuhuhuhu
SMTP.Enabled Thuhuhuhu
SMTP.Recipient e.bauthuhuhuhuhuhuhu
SMTP.Server mail.huhuhuhuhuhuhu
SMTP.Username Adam.bhuhuhuhuhuhuhu
SMTP.Sender Adam.bhuhuhuhuhuhuhu
SMTP.Password Qz9fhuhuhuhu
SMTP.Port 5huhuhuhu
SMTP.UseSsl fhuhuhuhu
SMTP.Authentication 1huhuhuhu
HTTP.Enabled Fhuhuhuhu
HTTP.GateUrl [builder placeholder] @Ghuhuhuhu
Telegram.Enabled Fhuhuhuhu
Telegram.BotToken [builder placeholder] @Strhuhuhuhu
Telegram.ChatId [builder placeholder] @Chuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

DarkCloud SMTP.Recipient EMAILmalicious
e.bauthuhuhuhuhuhuhu
8e430e4ba5cdcacfb6b5125755e6944a
DarkCloud SMTP.Server CNCmalicious
mail.huhuhuhuhuhuhu
8e430e4ba5cdcacfb6b5125755e6944a
DarkCloud SMTP.Username EMAILmalicious
Adam.bhuhuhuhuhuhuhu
8e430e4ba5cdcacfb6b5125755e6944a
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙