finesse Crypto Drainer 9c933ae7

Detects a crypto drainer that usually appears on websites that impersonate the Discord Bots MEE6 and Dyno.

References

IOK Rule (edit) 

title: finesse Crypto Drainer 9c933ae7
description: |
    Detects a crypto drainer that usually appears
    on websites that impersonate the Discord Bots
    `MEE6` and `Dyno`.

references:
    - https://urlscan.io/result/9c933ae7-b793-4bf6-8cb2-2fae91bc5c27
    - https://urlscan.io/result/a2b44a14-8f67-4af5-ab79-048c8d4590b0

detection:

    drainerSettings:
      requests|contains: 'settings'
      
    drainerKeywords:
      js|contains|all:
        - 'finesseReceiveAddress'
        - 'minETHFinesse'
        - 'lastUsedNonce'

    condition: drainerSettings and drainerKeywords

tags:
  - kit
  - cryptocurrency
  - cryptocurrency.ethereum