Extracted

• • Target

    1368c5c6d641570b1402adca6e7be846_JaffaCakes118

  • Size

    1.1MB

  • MD5

    1368c5c6d641570b1402adca6e7be846

  • SHA1

    86f2be85cd5539765cb2929b9b17fc6f81a90673

  • SHA256

    195c8edd53b0bead92afcf59d84011f774471c10f1456242296eac55a40fca76

  • SHA512

    bc711238fb49850a863afa5727aad8325b61bd398d03e15e03083de0c7198d892957e12405c363eae30df43c0d2513f93be512d24fb685a4262177afdb96a084

  • SSDEEP

    24576:6u6Jx3O0c+JY5UZ+XC0kGso/WaKF8lInYSHgWY:MI0c++OCvkGsUWaKBY

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2