Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1687213F2031468FDA607DD99EA762F9C323771BDEEA590482BEC4AD086D3DD5C81B501 |
|
CONTENT
ssdeep
|
384:ibr9sdLvjiIhO5PlXSu6QOnpwTBt5wcg136NDtO34HJu3PpZSt5zgY36gsmF1X50:wr9sdLe7vFOnpwTBt5wcg136VtO34HJg |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
898a73d5a362c937 |
|
VISUAL
aHash
|
0018183f3f180000 |
|
VISUAL
dHash
|
d032b0f372b00110 |
|
VISUAL
wHash
|
583c3cffbff88000 |
|
VISUAL
colorHash
|
300000000c9 |
|
VISUAL
cropResistant
|
d032b0f372b00110 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 17540 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.