Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T122042A21B1C8642A406385E4F06B7709B56FB30EDA05897CE4BAE5D0FFB6CED11263D6 |
|
CONTENT
ssdeep
|
3072:uCivTSB12yeOBm6RDrlI6RDrlE6RDrlYo+9TGpvLbo3ll/YIL4WqXpykjF:+vTSB12yeOBQoIGpvLbM/Ys4WqZyu |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f37656cc89899989 |
|
VISUAL
aHash
|
e6e6e7e7efffe7e7 |
|
VISUAL
dHash
|
4c4c4d4f5f514d4f |
|
VISUAL
wHash
|
000007070f0d0507 |
|
VISUAL
colorHash
|
07c00008000 |
|
VISUAL
cropResistant
|
4c4c4d4f5f514d4f,05603834198ce631,5159713131616969,e76761676767656c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 106 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
Pages with identical visual appearance (based on perceptual hash)