Malicious
Malicious

f61c8497f17d00be8c4adbd3fc49c0cf

VB5/6 Executable
MD5: f61c8497f17d00be8c4adbd3fc49c0cf
Size: 471.04 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 460 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 17 embedded or derived files and a malware configuration (DarkCloud configuration). It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c
MD5
f61c8497f17d00be8c4adbd3fc49c0cf
Verdict
Malicious
File type
VB5/6 Executable · 460 KB
Family
DarkCloud Stealer
Category
Stealer

Cite this report: https://app.malva.re/sha256/0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Visual Basic 5/6 Executable
Size
471.04 KB · 471,040 B
First seen
2026-08-18 12:01 · 2 months ago
Last seen
2026-08-18 12:01 · 2 months ago
Last analysis
2026-10-26 02:34 · 2 hours ago
Hashes
MD5 f61c8497f17d00be8c4adbd3fc49c0cf Sha1 661e474ccf2a5b99dbd0574a6155243d95347673 Sha256 0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c Sha384 813f5ae70bcd49782d785c1602ae352442699f668455c1ae50079f45530c72dc0a95cea3ff193165c387b7e7c0f516d5 Sha512 3d298fbcb0995a5508b60436f59b121f755c19b622362ac760bc2a3bd1b9efbb8eef81621f32e08f43031ad16aca0b03786c04cdefa2888dc011a0bbc2e0ac20 SSDeep 12288:FzpKN+kRKfJyV9afBbiS8xwy2dYskqZa77qwjYKkJj6GmZU:FzpKNVKfKZxwFdYsk2a7WmYb6nZ TLSH 25A42916E721602EF192C5B1E6D4966BA815AD371688AC1BF3C24F4931369D3ECF132F
Detection
PeID
Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Microsoft Visual C++ v6.0 DLLProtect Shareware V1.1 -> eCompserv CMS

1 malicious · 18 files
EXEf61c8497f17d00be8c4adbd3fc49c0cfDarkCloud Stealer
Structure
BINVB6
BINDecompilation
BIN[VB6 project]
TXTProject1.vbp
FRMForm1.frm
FRXForm1.frx
BASModule1.bas
BASModule2.bas
BASModule3.bas
BASModule5.bas
BASModule7.bas
BASVBRF_Types.bas
BASVBRF_Inconnu.bas
TXTEXPORT-NOTES.txt
BINDarkCloud
BINConfiguration
BINResources
BINCUSTOM
BINID:0067
EXEID:1033
Structure
DLL[UPX unpacked Nrv2ELe32].dll
Structure
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
BINRT_ICON
BINID:7531
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
malicious 5 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
Extraction method VBReFohuhuhuhuhuhuhuhuhuhuhu
Exfiltration configuration complete Fhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
VB6 decompilation
VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native).
DarkCloud extraction 
Exfiltration configuration is partial; unresolved expressions are not evaluated or guessed.
DarkCloud extraction
VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation.

1 malicious · 18 files
EXEf61c8497f17d00be8c4adbd3fc49c0cfDarkCloud Stealer
Structure

Config. Field Value
Extraction method VBReFohuhuhuhuhuhuhuhuhuhuhu
Exfiltration configuration complete Fhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙