Malicious
dc144374ec964585b6b9a1623626af99
VB5/6 Executable
MD5: dc144374ec964585b6b9a1623626af99
Size: 471.04 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 460 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876
- MD5
- dc144374ec964585b6b9a1623626af99
- Verdict
- Malicious
- File type
- VB5/6 Executable · 460 KB
- Family
- DarkCloud Stealer
- Category
- Stealer
- C2 (defanged)
mail[.]mokasco[.]com
Cite this report: https://app.malva.re/sha256/b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876
Related DarkCloud Stealer samples
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3 2026-10-19
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- 367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
471.04 KB · 471,040 B
First seen
2026-09-10 11:30 · one month ago
Last seen
2026-09-10 11:30 · one month ago
Last analysis
2026-10-26 02:40 · an hour ago
Hashes
MD5
dc144374ec964585b6b9a1623626af99
Sha1
f765bb414697cee330ff39972b93b52693d4d355
Sha256
b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876
Sha384
037296ffbf96889a7a4559474ecfa568714116d71a6e56e422eb6f1c2d7e2b20eae9ee11e77b80e6908e5d6e632cb1f6
Sha512
f63625c2c1bc4210a6eab102f1bcfe1927f9cd28322413ff5211b642ed018ac708dda1378a77d5814735e116e8c992982ac7f3c5cea891079080398663d7544e
SSDeep
6144:R8d1/w5KA81IJ8GpF6nuTmOOUiBUrjt4zC4uUp95KxjS7RemjdZywWDWnJaG+qfe:6jYKkJj6GmZUiqrye4jKOrhZywWD4cn
TLSH
1FA43A03EA60612EF1A389F1A8B5629668267D3A17DCE88BF3405F5935315D3ACF131F
Detection
PeID
Free Pascal v0.99.10MASM/TASM - sig4 (h)Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS
1 malicious · 17 files
EXEdc144374ec964585b6b9a1623626af99DarkCloud Stealer
Structure
BINVB6
BINDecompilation
BIN[VB6 project]
TXTProject1.vbp
FRMForm1.frm
FRXForm1.frx
BASModule1.bas
BASModule2.bas
BASModule3.bas
BASModule5.bas
BASModule7.bas
BASVBRF_Types.bas
BASVBRF_Inconnu.bas
TXTEXPORT-NOTES.txt
BINResources
BINRT_ICON
BINID:7531
BINID:0
BINID:7532
BINID:0
BINID:7533
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:1033
BINDarkCloud
BINConfiguration
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| Version | 4huhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | Adam.bhuhuhuhuhuhuhu |
| SMTP.Sender | Adam.bhuhuhuhuhuhuhu |
| SMTP.Password | Qz9fhuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |
DarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username
EMAILmalicious
Adam.bhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 17 files
EXEdc144374ec964585b6b9a1623626af99DarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINResources
BINDarkCloud
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| Version | 4huhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | Adam.bhuhuhuhuhuhuhu |
| SMTP.Sender | Adam.bhuhuhuhuhuhuhu |
| SMTP.Password | Qz9fhuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialDarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
dc144374ec964585b6b9a1623626af99
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
dc144374ec964585b6b9a1623626af99
DarkCloud SMTP.Username
EMAILmalicious
Adam.bhuhuhuhuhuhuhu
dc144374ec964585b6b9a1623626af99
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account