Fake crypto mining - noChromium

Detects a malicious DApp that force redirects when it detects the use of a Chromium based browser. Pretends to be a liquidity mining platform while presenting fake audit reports.

References

IOK Rule (edit) 

title: Fake crypto mining - noChromium

description: |
    Detects a malicious DApp that force redirects when it detects the
    use of a Chromium based browser. Pretends to be a liquidity mining
    platform while presenting fake audit reports.

references:
    - https://urlscan.io/result/ca867e6b-1175-475a-8a0f-fdaf839f09cb/
    - https://urlscan.io/result/581a66ed-dd74-45ff-81b0-ef3fd094bd8b/
    - https://urlscan.io/result/3bf65041-f47e-4b4f-9b6b-997baa7ba1ce/

detection:

    identifier1:
      requests|contains|all:
        - 'wusdt/css'
        - 'wusdt/img'
        - 'wusdt/ercjs'
        - 'static/alert'
        - 'wusdt/js'

    identifier2:
      html|contains|all:
        - "window.chrome"

    condition: identifier1 or (identifier1 and identifier2)

tags:
  - cryptocurrency