Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C8B33130C41CA8EE637FDE8BD1477091936EA10A3AA77570844F25BE11CAFADE153D62 |
|
CONTENT
ssdeep
|
768:BS5HmHmz+1lrr5qWKybZvN27zP1iXINHUewZvNbZvNbZvNAvlfEX77451KAJkg:BeSp8ybZvN0iRewZvNbZvNbZvNEEK8g |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8bd7340d9b78cc25 |
|
VISUAL
aHash
|
0f07031d1f1f0707 |
|
VISUAL
dHash
|
7fef6f69eb639fff |
|
VISUAL
wHash
|
0f0f031f1f1f070f |
|
VISUAL
colorHash
|
11000000190 |
|
VISUAL
cropResistant
|
7fef6f69eb639fff |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 1 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.