Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FBD297742218593F114742E8B332377B62E15389CB0A121D56F987FC8BEAD89FC3B599 |
|
CONTENT
ssdeep
|
384:TJQVf3S4s4/MNoIsClGUsenQ8VUIId+zF7CPfXz5UOMXrYuoewfyfccPQS756Uk5:+pKlGUsenQJIIYy7lM7Y/n |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8c4b5c997636cc36 |
|
VISUAL
aHash
|
1858783f1f1f1f1f |
|
VISUAL
dHash
|
b2f2f2c6beb2b636 |
|
VISUAL
wHash
|
1818781e1f1f1f1f |
|
VISUAL
colorHash
|
380000001c0 |
|
VISUAL
cropResistant
|
b2f2f2c6beb2b636 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 394 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.