This repository contains a variety of private source code samples for various crypto drainers along with the yara rules to detect them. These file samples where found with the Synthient Threat Intel Platform and have been uploaded here for other researchers to analyze.
Note
Password for all samples is infected
Caution
Do not run these samples on your host machine. They are malicious and have not been vetted for backdoors. This is purely for other researchers to analyze and understand the code.
| Sample Name | Yara Rule |
|---|---|
| Inferno Drainer | InfernoDrainerJS.yar |
| Ethane Drainer | EthaneDrainerJS.yar |
| UNIQUE Drainer | UniqueDrainerPage.yar |
| Solana Phantom Drainer | PhantomDrainerPage.yar |
Note
Scripts ending in Page, match the drainer landing page. Scripts ending in JS, match the drainer javascript.
Included is a scanner for detecting the various samples. It uses the yara rules to scan and detect a match.
pip3 install -r requirements.txtpython3 main.py --url https://example.comExample Output:
Detected InfernoDrainerJS