Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15842F431A142586B6AB7F8C0D1203F2E35A7E30FC55AD4185AFC8F864FC7DB4B8256A5 |
|
CONTENT
ssdeep
|
96:TGvvQnVo0/tvRvEssi0ssgqm1gutEcHia1/xv1w1adL+FLKOaiCb7QRYNBjib+iI:avYn9lm9iFsEN7txQxI5j6E |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c99999c927666666 |
|
VISUAL
aHash
|
1818181818181818 |
|
VISUAL
dHash
|
b2b232b2b2b1b0b0 |
|
VISUAL
wHash
|
181e58b8f9f9d858 |
|
VISUAL
colorHash
|
38000000180 |
|
VISUAL
cropResistant
|
b2b232b2b2b1b0b0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.