Malicious
VB5/6 Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
The file 98c2b612943a03187db933bb58c2476a is a VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 11 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Malicious
- File type
- VB5/6 Executable
- Family
- DarkCloud Stealer
- Category
- Stealer
- C2 (defanged)
mail[.]mokasco[.]com
Related DarkCloud Stealer samples
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3 2026-10-19
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS
1 malicious · 17 files
EXE98c2b612943a03187db933bb58c2476aDarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINResources
BINDarkCloud
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | asif.qhuhuhuhuhuhuhu |
| SMTP.Sender | asif.qhuhuhuhuhuhuhu |
| SMTP.Password | 9xsohuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |
DarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username
EMAILmalicious
asif.qhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential