Malicious
VB5/6 Executable
MD5: dc144374ec964585b6b9a1623626af99
Size: 471.04 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 460 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 16 embedded or derived files, a malware configuration (DarkCloud configuration) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876
- MD5
- dc144374ec964585b6b9a1623626af99
- Verdict
- Malicious
- File type
- VB5/6 Executable · 460 KB
- Family
- DarkCloud Stealer
- Category
- Stealer
- C2 (defanged)
mail[.]mokasco[.]com
Cite this report: https://app.malva.re/sha256/b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876
Related DarkCloud Stealer samples
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3 2026-10-19
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- 367383cfaa2ffc1404ba4ac1364a96992d78e036a0a67c994fbd6686f636474e 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
471.04 KB · 471,040 B
First seen
2026-09-10 11:30 · one month ago
Last seen
2026-09-10 11:30 · one month ago
Last analysis
2026-10-26 02:40 · an hour ago
Hashes
MD5
dc144374ec964585b6b9a1623626af99
Sha1
f765bb414697cee330ff39972b93b52693d4d355
Sha256
b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876
Sha384
037296ffbf96889a7a4559474ecfa568714116d71a6e56e422eb6f1c2d7e2b20eae9ee11e77b80e6908e5d6e632cb1f6
Sha512
f63625c2c1bc4210a6eab102f1bcfe1927f9cd28322413ff5211b642ed018ac708dda1378a77d5814735e116e8c992982ac7f3c5cea891079080398663d7544e
SSDeep
6144:R8d1/w5KA81IJ8GpF6nuTmOOUiBUrjt4zC4uUp95KxjS7RemjdZywWDWnJaG+qfe:6jYKkJj6GmZUiqrye4jKOrhZywWD4cn
TLSH
1FA43A03EA60612EF1A389F1A8B5629668267D3A17DCE88BF3405F5935315D3ACF131F
Detection
PeID
Free Pascal v0.99.10MASM/TASM - sig4 (h)Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Protect Shareware V1.1 -> eCompserv CMS
1 malicious · 17 files
EXEdc144374ec964585b6b9a1623626af99DarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINResources
BINDarkCloud
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Thuhuhuhu |
| Version | 4huhuhuhu |
| StagingDirectory | %AppDahuhuhuhuhuhuhuhuhuhuhu |
| FTP.Enabled | Fhuhuhuhu |
| FTP.Server [builder placeholder] | @Strhuhuhuhuhuhuhu |
| FTP.Username [builder placeholder] | @Sthuhuhuhu |
| FTP.Password [builder placeholder] | @Sthuhuhuhu |
| SMTP.Enabled | Thuhuhuhu |
| SMTP.Recipient | e.bauthuhuhuhuhuhuhu |
| SMTP.Server | mail.huhuhuhuhuhuhu |
| SMTP.Username | Adam.bhuhuhuhuhuhuhu |
| SMTP.Sender | Adam.bhuhuhuhuhuhuhu |
| SMTP.Password | Qz9fhuhuhuhu |
| SMTP.Port | 5huhuhuhu |
| SMTP.UseSsl | fhuhuhuhu |
| SMTP.Authentication | 1huhuhuhu |
| HTTP.Enabled | Fhuhuhuhu |
| HTTP.GateUrl [builder placeholder] | @Ghuhuhuhu |
| Telegram.Enabled | Fhuhuhuhu |
| Telegram.BotToken [builder placeholder] | @Strhuhuhuhu |
| Telegram.ChatId [builder placeholder] | @Chuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |
DarkCloud SMTP.Recipient
EMAILmalicious
e.bauthuhuhuhuhuhuhu
DarkCloud SMTP.Server
CNCmalicious
mail.huhuhuhuhuhuhu
DarkCloud SMTP.Username
EMAILmalicious
Adam.bhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential