Extracted

• • Target

    144ddfe3c0e62e05b8ce0939d1f29d135607af839db81b15930ca7d7573470e8

  • Size

    1.1MB

  • MD5

    595a48b5a1d9c536fe7f7d3990e2d565

  • SHA1

    13436cb9e9402b6d56e16abb0fe49bfcde2bf44c

  • SHA256

    144ddfe3c0e62e05b8ce0939d1f29d135607af839db81b15930ca7d7573470e8

  • SHA512

    f25ba8884c6b324fc03bec5c88b7cecc4c58a464c0fb6aa0c83d796798bce1a8f214b9707be3444077bfeadd50d6ec0435001cc51c34169fdef5f4253194b453

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger Payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2