Extracted

• • Target

    47e051f21f5dc9c2db736a28b20e0ba7a18dff61a21a98f04f4844a1e59ac13b

  • Size

    1.1MB

  • MD5

    6532fa3ba88fd39e3c3d0e4843b70af8

  • SHA1

    b09c725fc85ee4342089122df8bf4efea8fa8d1a

  • SHA256

    47e051f21f5dc9c2db736a28b20e0ba7a18dff61a21a98f04f4844a1e59ac13b

  • SHA512

    15530f43cc76dde6725a6b14a4e1fecb51458232ed838e7183c4418a875afeecfdc767ae0c4a386ee5bc2af0060063c11106e89e256b09f6fd64151fededc6eb

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2