Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10E13459CB1C018AA1973E2C7DDB02F41A0FAF33AED5E2915A3E902494ED7D76346076D |
|
CONTENT
ssdeep
|
192:AZTE1+LJiZ9FAa44KT2qliM+QZ1TOlT8DTitnA6IcbaoYU:yE1+LE7iT2EiMvZ1TOlT8DTWAxvoYU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9230cded9e1a4dcc |
|
VISUAL
aHash
|
07470604fffb7e7e |
|
VISUAL
dHash
|
0e9ccc9c2cc2c4d4 |
|
VISUAL
wHash
|
07470604ff607e7e |
|
VISUAL
colorHash
|
38006000040 |
|
VISUAL
cropResistant
|
0e9ccc9c2cc2c4d4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 67 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.