Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1533543B8171C3E2C942B87E4F765F769126CA190FA5AD0A8D67C617017CBC89F83B9C4 |
|
CONTENT
ssdeep
|
1536:2C8qYCnuv1uv1uv1uv1uvSGuv1uv1uv1uv161uv1uv1uv1uv16Luv1uv1uv1uv1S:tDnHAFGCwbQBUjeblHAGjtzYAj8zEsGq |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8cf3d0cc622eb917 |
|
VISUAL
aHash
|
fffc1f0110181010 |
|
VISUAL
dHash
|
0fc0fe27b0b233b3 |
|
VISUAL
wHash
|
ffff3f1318181018 |
|
VISUAL
colorHash
|
39000030000 |
|
VISUAL
cropResistant
|
29180681f07e9f67,b03c262b2b263cb0,c698307272727373,0010686868201000,4030984422918cca,f87fa3b0b2b337b3 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 66 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
Pages with identical visual appearance (based on perceptual hash)