General

  • Target

    ca6d815b7d45433efaac9183760790a4f5226ec88922395bd4b9103be8f9633c

  • Size

    134KB

  • Sample

    220701-ekyg3sdaa2

  • MD5

    c14cb410df25802ad0cffd4a3b5688a8

  • SHA1

    5c32026c7d195c648d1a11b62bd34f740fb2460b

  • SHA256

    ca6d815b7d45433efaac9183760790a4f5226ec88922395bd4b9103be8f9633c

  • SHA512

    2f24ef264f72d62236c5550ea778da528ebb364f9c6b9a76391f46d837dd9ba25de9044c6736c54bd4196d3d8a82d2382403b7bfcc755b134775bef23a810619

Malware Config

Targets

    • Target

      ca6d815b7d45433efaac9183760790a4f5226ec88922395bd4b9103be8f9633c

    • Size

      134KB

    • MD5

      c14cb410df25802ad0cffd4a3b5688a8

    • SHA1

      5c32026c7d195c648d1a11b62bd34f740fb2460b

    • SHA256

      ca6d815b7d45433efaac9183760790a4f5226ec88922395bd4b9103be8f9633c

    • SHA512

      2f24ef264f72d62236c5550ea778da528ebb364f9c6b9a76391f46d837dd9ba25de9044c6736c54bd4196d3d8a82d2382403b7bfcc755b134775bef23a810619

    • Phoenix Keylogger

      Phoenix is a keylogger and info stealer first seen in July 2019.

    • Phoenix Keylogger Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks