Extracted

• • Target

    ddc1ca6b9cabf78dd490c8ac27ba16fdbf70dc481443e08d63c3a2edcbf6ad36

  • Size

    1.1MB

  • MD5

    062320679a253df4d37961a6ce5b9870

  • SHA1

    5e3d73c7d48d1b85deb28f1120e76a3a8fb683ae

  • SHA256

    ddc1ca6b9cabf78dd490c8ac27ba16fdbf70dc481443e08d63c3a2edcbf6ad36

  • SHA512

    fee1178d2155f147ad2d8b613dad35cd6323175c3bb20476a8a506ad68d0b05b6eb3d9779078554675bd420634aa82dd0bbf6205a222401625e2ff2419417f4d

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2