Method of correlating distinct phishing campaigns by identifying shared Modus Operandi

A system having a memory, computer readable instructions, and one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:

• building, from a source code, an abstract syntax tree;
• building, from the abstract syntax tree, a decloaked abstract syntax tree;
• removing payload data from the decloaked abstract syntax tree to define an obfuscation pattern;
• comparing the obfuscation pattern to a plurality of predetermined obfuscation patterns;
• and
• correlating, based on the comparison, the source code to one or more phishing kits.

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

• building, from a source code, an abstract syntax tree;
• building, from the abstract syntax tree, a decloaked abstract syntax tree;
• removing payload data from the decloaked abstract syntax tree to define an obfuscation pattern;
• comparing the obfuscation pattern to a plurality of predetermined obfuscation patterns;
• and
• correlating, based on the comparison, the source code to one or more phishing kits.

A computer-implemented method comprising:

• receiving a dataset comprising a plurality of known phishing kits;
• building, for each phishing kit in the dataset, an obfuscation pattern;
• comparing the obfuscation patterns to identify one or more recurrent obfuscation patterns;
• and
• grouping, within the dataset, the plurality of known phishing kits into two or more sets, each respective set comprising phishing kits having a same recurrent obfuscation pattern.

A system having a memory, computer readable instructions, and one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:

• receiving a dataset comprising a plurality of known phishing kits;
• building, for each phishing kit in the dataset, an obfuscation pattern;
• comparing the obfuscation patterns to identify one or more recurrent obfuscation patterns;
• and
• grouping, within the dataset, the plurality of known phishing kits into two or more sets, each respective set comprising phishing kits having a same recurrent obfuscation pattern.