Extracted

• • Target

    d78a0419df93d26fedc18cda51b7f76900d640ffc9909ce98f60362d1a3d3bd1

  • Size

    1.1MB

  • MD5

    0e7f46ad37f486ea26e6987f6022ee71

  • SHA1

    18e3ef5b22ad2a046aac7b473fa02c9c6611a7bd

  • SHA256

    d78a0419df93d26fedc18cda51b7f76900d640ffc9909ce98f60362d1a3d3bd1

  • SHA512

    c22364a850add02a88baf2a8ad719b15b6cf2d3cc8d4d0859ece1a6968a90656d72da0abf159406fb7af42462c4d0e2bb22aa54d0475bb74a7f68bf8009d7e14

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2