Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D953EFF191A6C43B2177C2D590AB9B3B30E2A14DEE56444A83FC43BD5BDECA9BC06D05 |
|
CONTENT
ssdeep
|
1536:Z8ur9T3tNKZ1Ek/91j2eqK/9Wwvx1tx/ui6QBq/j+hsJpKoINBMhUQb4iuzbTBuH:Zfhzv |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8ded721e88e322dc |
|
VISUAL
aHash
|
8100c37b1c008000 |
|
VISUAL
dHash
|
072317f3320c0811 |
|
VISUAL
wHash
|
e181dafb1f06fc80 |
|
VISUAL
colorHash
|
38031040000 |
|
VISUAL
cropResistant
|
00122c9696866002,072317f3320c0811 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 6153 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.