Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CA234434A510647B13239BC5B5A19F8FB6D2A30ECB13D462F1F9639653CDEE088119BB |
|
CONTENT
ssdeep
|
384:YgCVcc/oqrnbgz9YQwYQpeoUNIJEDyo2FNFpg:Hnc/oscRYQwYQpeoWIJE63Fpg |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
97996f64243697c4 |
|
VISUAL
aHash
|
001c3e0e06123030 |
|
VISUAL
dHash
|
1a58783cd6eeeee6 |
|
VISUAL
wHash
|
0a3e3e0e7e167272 |
|
VISUAL
colorHash
|
380020001c0 |
|
VISUAL
cropResistant
|
3c248cd8f09c9e26,1a58783cd6eeeee6 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 316 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.