Malicious
VB5/6 Executable
MD5: f61c8497f17d00be8c4adbd3fc49c0cf
Size: 471.04 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 460 KB VB5/6 Executable identified by Malva.RE as DarkCloud Stealer (stealer). Static analysis extracted 17 embedded or derived files and a malware configuration (DarkCloud configuration). It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c
- MD5
- f61c8497f17d00be8c4adbd3fc49c0cf
- Verdict
- Malicious
- File type
- VB5/6 Executable · 460 KB
- Family
- DarkCloud Stealer
- Category
- Stealer
Cite this report: https://app.malva.re/sha256/0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c
Related DarkCloud Stealer samples
- cc366589246f7c04e7c2c8ceb32a418a4fea049a762cf9de76995398676f6ee3 2026-10-19
- ab591ad7690f82e3d04a40cae5bb9d9692fdce339e360f571f5079fa4a49f21d 2026-10-19
- a8fca85b5837e1c55ae7e06d68bb2d29b05c6b149d4eec1e3cfff8aec32ff7c1 2026-10-19
- 22617cda3a45606794185916e4fc5effc3aaf980f0b6b669dc0fabef1e12ca61 2026-10-19
- 1184d9505dd506ce7d0afd5c748c81e92a84d45445f2f86e4c545727f1bc5ca3 2026-10-19
- b4bb50abcc77b1760cd355884d25cb7f29e13d7cf7524905bbef9a25cd058876 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Visual Basic 5/6 Executable
Size
471.04 KB · 471,040 B
First seen
2026-08-18 12:01 · 2 months ago
Last seen
2026-08-18 12:01 · 2 months ago
Last analysis
2026-10-26 02:34 · an hour ago
Hashes
MD5
f61c8497f17d00be8c4adbd3fc49c0cf
Sha1
661e474ccf2a5b99dbd0574a6155243d95347673
Sha256
0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c
Sha384
813f5ae70bcd49782d785c1602ae352442699f668455c1ae50079f45530c72dc0a95cea3ff193165c387b7e7c0f516d5
Sha512
3d298fbcb0995a5508b60436f59b121f755c19b622362ac760bc2a3bd1b9efbb8eef81621f32e08f43031ad16aca0b03786c04cdefa2888dc011a0bbc2e0ac20
SSDeep
12288:FzpKN+kRKfJyV9afBbiS8xwy2dYskqZa77qwjYKkJj6GmZU:FzpKNVKfKZxwFdYsk2a7WmYb6nZ
TLSH
25A42916E721602EF192C5B1E6D4966BA815AD371688AC1BF3C24F4931369D3ECF132F
Detection
PeID
Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0Microsoft Visual Basic v5.0 - v6.0Microsoft Visual C++ v6.0 DLLProtect Shareware V1.1 -> eCompserv CMS
1 malicious · 18 files
EXEf61c8497f17d00be8c4adbd3fc49c0cfDarkCloud Stealer
Structure
BINVB6
BIN[VB6 project]
BINDarkCloud
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Extraction method | VBReFohuhuhuhuhuhuhuhuhuhuhu |
| Exfiltration configuration complete | Fhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| VB6 decompilation | VBReFormer 1.0.0+eed41cd404617014a6bab3b9a7b7e1fe6774591b: 11 project files (native). |
| DarkCloud extraction | |
| DarkCloud extraction | VBReFormer reconstruction diagnostics are retained separately under VB6/Decompilation. |