Overview

overview

10

Static

static

5

8dbc0ee673...18.exe

windows7-x64

10

8dbc0ee673...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8dbc0ee673c657836ef7545b21279bb7_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240602-mbz9baah64

  • MD5

    8dbc0ee673c657836ef7545b21279bb7

  • SHA1

    c028e8800b860b8b55eaef741dbfad7f75a1faff

  • SHA256

    f0269becabc7ac8356de24d36a9fe0b03e708da26d5062bf94b8ab8073462702

  • SHA512

    f3b3d0b11fdcd528e1b6c4a701cb9c444823c687e487fd5740b997a8ab0bc50a9e38122f9300ad2ac2850fcbbe9c9785abd48e75d8900f873955201967e79324

  • SSDEEP

    24576:Eyu6Jx3O0c+JY5UZ+XC0kGso/WaZjIF8SyWY:E0I0c++OCvkGsUWaZGY

Score
10/10
phoenixcollectionkeyloggerstealer

Malware Config

Targets

    • Target

      8dbc0ee673c657836ef7545b21279bb7_JaffaCakes118

    • Size

      1.1MB

    • MD5

      8dbc0ee673c657836ef7545b21279bb7

    • SHA1

      c028e8800b860b8b55eaef741dbfad7f75a1faff

    • SHA256

      f0269becabc7ac8356de24d36a9fe0b03e708da26d5062bf94b8ab8073462702

    • SHA512

      f3b3d0b11fdcd528e1b6c4a701cb9c444823c687e487fd5740b997a8ab0bc50a9e38122f9300ad2ac2850fcbbe9c9785abd48e75d8900f873955201967e79324

    • SSDEEP

      24576:Eyu6Jx3O0c+JY5UZ+XC0kGso/WaZjIF8SyWY:E0I0c++OCvkGsUWaZGY

    Score
    10/10
    phoenixcollectionkeyloggerstealer

    • Phoenix Keylogger

      Phoenix is a keylogger and info stealer first seen in July 2019.

      stealerkeyloggerphoenix

    • Phoenix Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks