Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C32365306005963F672783E8B225669AD0C6F346CE568BC563FDA266EBCECF56C33144 |
|
CONTENT
ssdeep
|
768:TBgeWRSOqEhffa4oJrRjRQJ2RhfMqwzz4aRyJmRJJ2R8J1R1W71QyN674XLB:Tu3a4oJrRjRQJ2RZMqw/4aRyJmRJJ2Rh |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
813b846fb4c56d95 |
|
VISUAL
aHash
|
0008080000207e7e |
|
VISUAL
dHash
|
a9b95212b651cce4 |
|
VISUAL
wHash
|
fd7d180802387e7e |
|
VISUAL
colorHash
|
31201200001 |
|
VISUAL
cropResistant
|
d2d2c08e6d6c6363,a9b95212b651cce4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 54680 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.