Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14BB229E973206AE07657EBD8F866B526B04338BEDB40DA14D3EC9FC5A1C16A4DC52CC0 |
|
CONTENT
ssdeep
|
384:NVhO+0TzpC9sxhWRZK8NPlqEi+lVPxyvLv6ElI/9C2eBmbeNmyLCL4gOWL:NVhO+0TzpC9sxhWWgPuW8m8IheBmaN/Q |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ed84128b3eb469cb |
|
VISUAL
aHash
|
fffffbfbb9fbff00 |
|
VISUAL
dHash
|
8008523773538c23 |
|
VISUAL
wHash
|
00fff19181f9ff00 |
|
VISUAL
colorHash
|
0e019040000 |
|
VISUAL
cropResistant
|
c20dd2377763924c,80002000032bc100 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 1084 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.