Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15A83303105888439B7A767E0F5B3BF27603C42CCD61F41A8EA6C3675B3839A9E86535D |
|
CONTENT
ssdeep
|
384:2GyZF76yMZP0ZPcN6NNkQkx2Sb3SicS1XfQp7azRU1rutdpru9X1Y1:dyH76y6CSYKJx241qydpcX1c |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c9c91e3ea7213273 |
|
VISUAL
aHash
|
19185b5be3181810 |
|
VISUAL
dHash
|
31b2b29296b23322 |
|
VISUAL
wHash
|
19787bfbe31a1818 |
|
VISUAL
colorHash
|
300002c0008 |
|
VISUAL
cropResistant
|
32e38842cadad8f1,6ede7a32f1d89ed0,9cbc727171909af1,31b2b29296b23322 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 125 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.