Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T145E26410E0F15D3B006FB5E1E1EAA74465E7C387C68227E2C2E8975D4BD2C18ED7B2A5 |
|
CONTENT
ssdeep
|
384:IyGdVDhAgcTliM1QDhHNeIUJI4gcCoC42SeleVM1rl+rfVfZkc5ER28fHk7AVW:IyuDhp+liM1QJNeIUJS42SeIDt3X |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cd0fb696b06969c2 |
|
VISUAL
aHash
|
bf3e3999bff9ffff |
|
VISUAL
dHash
|
6574537370e20000 |
|
VISUAL
wHash
|
bf3a38183c7cc0c0 |
|
VISUAL
colorHash
|
07000c00000 |
|
VISUAL
cropResistant
|
6574537370e20000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 36 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.