Extracted

• • Target

    9955face1106764a92d02dcbd4d0417b_JaffaCakes118

  • Size

    1.1MB

  • MD5

    9955face1106764a92d02dcbd4d0417b

  • SHA1

    a19dfeb661ccdc34c248ce8698bd84eedf6aaa47

  • SHA256

    a9379eb4a91d9f04a767d45d65435df1dd021c17ea802c69de3b3509b93a22f3

  • SHA512

    078dd148e82b8251007273fcf42d07dca99954a0d8c44098e99f25ef042bf8014ead059db5f4595b22ae0b72f3c5ac7b77d24c54a7d8fec21159ac770c547e9d

  • SSDEEP

    24576:Tu6Jx3O0c+JY5UZ+XC0kGso/WaY7pLCKPTUWY:9I0c++OCvkGsUWaYhY

  Score

  10^/10

  phoenixcollectionkeyloggerstealer

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix

  • Phoenix Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2