Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13353C7F6A1C050A11003AFA7F433698AE98BBC7DCB40FDE181A186E755D99EC8907F57 |
|
CONTENT
ssdeep
|
768:abCjOstcByBjBJBYTEhO4tlIaIpIVE4L3XCJ52+eE16DNB7wODouD9r2XViWzXHX:t2ByBjBJBI4tBl+ek6DNBkOpZ8iiXX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
af5a845a0e5a3e5a |
|
VISUAL
aHash
|
bdff81818181ffbf |
|
VISUAL
dHash
|
710241030303806b |
|
VISUAL
wHash
|
bdff01000081ffbf |
|
VISUAL
colorHash
|
070010001c0 |
|
VISUAL
cropResistant
|
710241030303806b |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 669 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.