Extracted

• • Target

    114d29dfb63b29c803a3e743808ca285e95b380b1378321dca2dff5742423246

  • Size

    1.4MB

  • MD5

    2b6e2751a6f1baf22c14eab5554cfcda

  • SHA1

    c5afbbcca8d59850427aff8823ca6169670a5fe5

  • SHA256

    114d29dfb63b29c803a3e743808ca285e95b380b1378321dca2dff5742423246

  • SHA512

    e992fc742f4e2abe44d70618aa39e859cdd09b894aaab0724e9e33d377f7125fbdeb7a8f469f48a0abe213c5658d4c1b1da698d0ab70c0477abafa95e78882ac

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger Payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2