Extracted

• • Target

    a4f7d54fa2a8b5748519d20fd65745ece3fc0ecd8685b48791acbf4e967d9727

  • Size

    1.1MB

  • MD5

    256c5f16b99d450af4d7481d2f90f13c

  • SHA1

    365e8600e9d6f0d3c8a30f7c9923c6a5b3602e17

  • SHA256

    a4f7d54fa2a8b5748519d20fd65745ece3fc0ecd8685b48791acbf4e967d9727

  • SHA512

    b3e612f5e9af348f2948d8ce54c180a3070ca3e95fbf47c055c9945f7b326100d122adb1f13a8da0f4e6cf9d2763b0dc7a6e7bb6711d383963d3a53d57ff1740

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2