Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T140432AF93D44B5561BA291D3B0AF365BB33A146F250C59B06060DEE970F84D9502BF8F |
|
CONTENT
ssdeep
|
768:byWuU/s1yPWulxS/u8n+892rtfqBXZz6jFLQiP8CHU+dcAX8U00uRe5VL5SxHyOe:EwgyOloQzZs8oWQbp |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9f5ad0c252721e1f |
|
VISUAL
aHash
|
fcbf0f071f3fef8f |
|
VISUAL
dHash
|
cc307c0d78701a1a |
|
VISUAL
wHash
|
7c030707073f8f8f |
|
VISUAL
colorHash
|
07000000e00 |
|
VISUAL
cropResistant
|
cc307c0d78701a1a,45453b98c42b5145 |
• Amenaza: Kit de phishing para robo de credenciales
• Objetivo: Usuarios de Trezor internacionalmente
• Método: Página falsa de descarga para la app Trezor Suite
• Exfil: Datos enviados a través de JavaScript ofuscado
• Indicadores: Hosting gratuito, JS ofuscado, URL no coincidente
• Riesgo: ALTO - Potencial distribución de malware
Pages with identical visual appearance (based on perceptual hash)