Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D7325537D1015527127F84D7E6BB730A11A3126ADA872B85B7FC02FB2FE5D6499322C2 |
|
CONTENT
ssdeep
|
192:yA9GdG9y9xmWL1Nxk2QicBAZzZc1rh/yPU7DCy60cA5w+XzEah2:pdWGqZCkPUXCy60cAhX4f |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cedf73646433118c |
|
VISUAL
aHash
|
b0b83c1038381111 |
|
VISUAL
dHash
|
6460716072616365 |
|
VISUAL
wHash
|
b0bcbc3838393d39 |
|
VISUAL
colorHash
|
38000030040 |
|
VISUAL
cropResistant
|
0000101010000080,6460716072616365 |
Victim connects wallet and signs malicious transactions. Attacker drains tokens across multiple blockchain networks using chain-specific draining methods (Approve, TransferFrom, Set Authority, etc.).
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.