SafeMode - Analysis: m.lmasv.xyz

Captura Visual

No screenshot available

Información de Detección

http://m.lmasv.xyz/

Detected Brand

Unknown

Country

Unknown

Confianza

100%

HTTP Status

200

Report ID

b32d6b3e-1a2…

Analyzed

2026-01-25 23:49

Final URL (after redirects)

http://m.lmasv.xyz/#/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T127E20E347003BC5B657396D1F862AF183646E736C2180F98B3E925BA6FDACF45862374
CONTENT ssdeep	768:9vVYKlgNle0ldJYNuYATmbtwdQgNYTGAgWBujY5Lf5LfZLftLf2rCtTzhBeC3L:9vVYKlgNle0l3YNuYzbtwdNNYTGAgWBV

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b333333323cccccc
VISUAL aHash	e7e7ffeff7efe7ff
VISUAL dHash	4d4d000c0c0c0c0c
VISUAL wHash	0707272727272727
VISUAL colorHash	07200038000
VISUAL cropResistant	4d4d000c0c0c0c0c,7efcfefcfcfcf8f1

Análisis de Código

Risk Score 100/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
document.write
hex_escape
unicode_escape
base64_strings

📡 API Calls Detected

POST
GET

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected multiple kit types: Credential Harvester, OTP Stealer, Card Stealer, and Banking kits.

High Obfuscation

108 obfuscation techniques detected, indicating deliberate evasion of analysis.

WebSocket Communication

1 WebSocket URL detected, suggesting real-time data exfiltration.

Large JavaScript Payload

Total JavaScript size of 2.28 MB, unusually large for a phishing page, indicating complex malicious functionality.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

real-time WebSocket exfiltration + obfuscated JavaScript

Canal de Exfiltración

WebSocket (1 endpoints)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
108 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Fake Service

Unknown (No specific brand impersonation detected)

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The phishing kit is designed to capture user credentials through fake login forms. The presence of a Credential Harvester kit suggests real-time interception and exfiltration of entered credentials via WebSocket or other communication channels.

Secondary Method: OTP and Payment Data Theft

The kit includes OTP Stealer and Card Stealer components, enabling the interception of one-time passwords and credit card details. This data is likely exfiltrated in real-time to an attacker-controlled server.