Extracted

• • Target

    f3c37e7f065b4a9ec6d9d6b05313b8027e13097a4ebec04f5e140a8d76f788cc

  • Size

    1.2MB

  • MD5

    ef8e516c22652113c8f17fb829b2ca13

  • SHA1

    f8a0ca2ab9bd896bceba01163995ce905d7218a1

  • SHA256

    f3c37e7f065b4a9ec6d9d6b05313b8027e13097a4ebec04f5e140a8d76f788cc

  • SHA512

    9737beda4f45efc01092ee9217eac06992451a58108f5a9a7dbb3f6a192fc3f26f774d84b0173f9d70218ce584b288953811642263aeeec7c60b1a0640c4eedd

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger Payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2