Malicious
VB5/6 Executable
MD5: bc589c855ee3009da44551fe80f4e1e3
Size: 471.04 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 460 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3
- MD5
- bc589c855ee3009da44551fe80f4e1e3
- Verdict
- Malicious
- File type
- VB5/6 Executable · 460 KB
- Family
- DarkCloud Stealer
- Category
- Stealer
- C2 (defanged)
mail[.]mokasco[.]com
Cite this report: https://app.malva.re/sha256/cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3
Related DarkCloud Stealer samples
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876 2026-09-10
- 367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
471.04 KB · 471,040 B
First seen
2026-10-19 08:15 · 6 days ago
Last seen
2026-10-19 08:15 · 6 days ago
Last analysis
2026-10-26 02:32 · an hour ago
Hashes
MD5
bc589c855ee3009da44551fe80f4e1e3
Sha1
d04ce442f7389f5efc490d3a5f838a59c14c6f92
Sha256
cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3
Sha384
2048874efb55ed038914dee6a87194ea8bfdc791315e8bfa3dfb8fdd706d9beb736e0a94b253eb08f46ec01ab1700eb0
Sha512
3a3465fb120e13c3bc06ed86f86301aa89edc48f91f0f401f396129d1b626a6a71fe5529c68ca55cac37b8f78926ce5c65953866c02ed4025a924922865b7685
SSDeep
6144:BnqA8d1/w5KA81IJ8GpF6nuTmOOUiBUrjjArHeGRl4o7qhmcY4d4uyPIQ2QV0CWz:BnojYKkJj6GmZUiqrXCx4f76uyPIvx
TLSH
0CA43903AA60A12DF1A3C9F1ACB5A29628267D3917DCE89BB3405F5935315D3ACF131F
Detection
PeID
Free Pascal v0.99.10MASM/TASM - sig4 (h)Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS
1 malicious · 17 files
EXEbc589c855ee3009da44551fe80f4e1e3DarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINDarkCloud
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| Version | 4huhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | Adam.bhuhuhuhuhuhuhu |
| SMTP.Sender | Adam.bhuhuhuhuhuhuhu |
| SMTP.Password | Qz9fhuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |
DarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username
EMAILmalicious
Adam.bhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential