Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T161932B71E5018D3C2F2F8BF6E41A22BED2569C0FB9A21870F56D63A37583F645B1701A |
|
CONTENT
ssdeep
|
1536:OsYwbgtX8/Yh7SK8zYgVomkZjaqq6QySe3H9q7rE6Y8yajisp7en3OwKE+GnIWnD:OfZaqq6DSCajispyn3OXE+GnIWnIjiDn |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b847c7383ec7c0cc |
|
VISUAL
aHash
|
ffcfdf8d8fcfffff |
|
VISUAL
dHash
|
881b3b393919060e |
|
VISUAL
wHash
|
7f898888888dc3ff |
|
VISUAL
colorHash
|
07c01000000 |
|
VISUAL
cropResistant
|
881b3b393919060e,79f547123f6c6703 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 1069 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
Pages with identical visual appearance (based on perceptual hash)