rusc Crypto Drainer f4180c6

Detects a crypto drainer that supports English & Russian in its logging messages. It also has its own configuration file called import_main.js and its main draining functionality in a file called main.js

References

IOK Rule (edit) 

title: rusc Crypto Drainer f4180c6
description: |
    Detects a crypto drainer that supports English
    & Russian in its logging messages.
    It also has its own configuration file called 
    `import_main.js` and its main draining functionality
    in a file called `main.js`

references:
    - https://urlscan.io/result/f4180c6d-54bb-4bb6-9123-bbc6490f3443

detection:

    drainerSettings:
      requests|contains: 'import_main.js'
      
    drainingFunctions:
      js|contains|all:
        - 'sendEth'
        - 'sendToken'
        - 'sendNFT'

    uniqueId:
      js|contains: 'scUniqueId'
  
    telegramConfig:
      js|contains: 'tgConfig'

    condition: drainerSettings and drainingFunctions and uniqueId and telegramConfig

tags:
  - cryptocurrency
  - cryptocurrency.ethereum