Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18314DE7D951919FD850ABFC8C66352933E8FF85A0B80C925E6A19A32AF3740CFDC3525 |
|
CONTENT
ssdeep
|
3072:prI2YVcpiYQVQWQ2PV5ktkMkhBBXh7o7P000kDJxxxxeGGGGGBBXh7o7P000kDXa:zQVQWQ2PV5ktkMk30Pr0Pz0P/ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
dccc3333c8cccc39 |
|
VISUAL
aHash
|
808898bc9eb480a0 |
|
VISUAL
dHash
|
0650242470245068 |
|
VISUAL
wHash
|
80b8bcb4beb684bc |
|
VISUAL
colorHash
|
380010001c0 |
|
VISUAL
cropResistant
|
0650242470245068 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 16871 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.