From a896a95adce071e070cea875d0e9d37e0401bbd7 Mon Sep 17 00:00:00 2001
From: ditekshen <ditekshen@outlook.com>
Date: Thu, 22 Feb 2024 15:26:54 +0300
Subject: [PATCH] Add and update rules

---
 yara/indicator_suspicious.yar | 37 +++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/yara/indicator_suspicious.yar b/yara/indicator_suspicious.yar
index a75b778..d2ec646 100644
--- a/yara/indicator_suspicious.yar
+++ b/yara/indicator_suspicious.yar
@@ -2232,6 +2232,16 @@ rule INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs {
         $s93 = "gojhcdgcpbpfigcaejpfhfegekdgiblk" ascii wide nocase // Opera Wallet
         $s94 = "djclckkglechooblngghdinmeemkbgci" ascii wide nocase // MetaMask
         $s95 = "jnmbobjmhlngoefaiojfljckilhhlhcj" ascii wide nocase // OneKey
+        $s96 = "jiidiaalihmmhddjgbnbgdfflelocpak" ascii wide nocase // Bitget Wallet
+        $s97 = "knhkeligkfmclgkeedceenpopaleokfh" ascii wide nocase // Tippin
+        $s98 = "agoakfejjabomempkjlepdflaleeobhb" ascii wide nocase // Core | Crypto Wallet
+        $s99 = "lgmpcpglpngdoalbgeoldeajfclnhafa" ascii wide nocase // SafePal
+        $s100 = "opcgpfmipidbgpenhmajoajpbobppdil" ascii wide nocase // Sui Wallet
+        $s101 = "nphplpgoakhhjchkkhmiggakijnkhfnd" ascii wide nocase // TON Wallet
+        $s102 = "bkklifkecemccedpkhcebagjpehhabfb" ascii wide nocase // MetaWallet
+        $s103 = "eajafomhmkipbjmfmhebemolkcicgfmd" ascii wide nocase // Taho
+        $s104 = "ebfidpplhabeedpnhjnobghokpiioolj" ascii wide nocase // Fewcha Move Wallet
+        $s105 = "lccbohhgfkdikahanoclbdmaolidjdfl" ascii wide nocase // Vigvam
     condition:
         (uint16(0) == 0x5a4d and 6 of them) or (12 of them)
 }
@@ -2592,3 +2602,30 @@ rule INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs {
     condition:
        uint16(0) == 0x5a4d and 10 of them
 }
+
+rule INDICATOR_SUSPICIOUS_EXE_Crypto_Wallet_Regex {
+    meta:
+        author = "ditekSHen"
+        description = "Detects executables referencing cryptocurrency wallet regular expressions"
+    strings:
+        $s1 = "^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$" ascii wide nocase // Bitcoin (BTC)
+        $s2 = "(?:^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$)" ascii wide nocase // Litecoin (LTC)
+        $s3 = "(?:^0x[a-fA-F0-9]{40}$)" ascii wide nocase // Ethereum (ETH)
+        $s4 = "(?:^G[0-9a-zA-Z]{55}$)" ascii wide nocase // Stellar Lumens (XLM)
+        $s5 = "^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)" ascii wide nocase // Monero (XMR)
+        $s6 = "(^[1-9A-HJ-NP-Za-km-z]{44}$)" ascii wide nocase // Solana (SOL)
+        $s7 = "T[A-Za-z1-9]{33}" ascii wide nocase // Tezos (XTZ)
+        $s8 = "(?:^r[0-9a-zA-Z]{24,34}$)" ascii wide nocase // Ripple (XRP)
+        $s9 = "^((bitcoincash:)?(q|p)[a-z0-9]{41})" ascii wide nocase // Bitcoin Cash (BCH)
+        $s10 = "(?:^X[1-9A-HJ-NP-Za-km-z]{33}$)" ascii wide nocase //Dash (DASH)
+        $s11 = "(?:^A[0-9a-zA-Z]{33}$)" ascii wide nocase // Ontology (ONT)
+        $s12 = "D{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}" ascii wide nocase // Dogecoin (DOGE)
+        $s13 = "(^0x[A-Za-z0-9]{40,40}?[\\d\\- ])|(^0x[A-Za-z0-9]{40,40})$" ascii wide nocase
+        $s14 = "(^D[A-Za-z0-9]{32,35}?[\\d\\- ])|(^D[A-Za-z0-9]{32,35})$" ascii wide nocase
+        $s15 = "^([13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})$" ascii wide nocase
+        $s16 = "(^X[A-Za-z0-9]{32,34}?[\\d\\- ])|(^X[A-Za-z0-9]{32,34})|(^7[A-Za-z0-9]{32,34})$" ascii wide nocase
+        $s17 = "(^t[A-Za-z0-9]{32,36})$" ascii wide nocase
+        $s18 = "(^(GD|GC)[A-Z0-9]{54,56})$" ascii wide nocase
+    condition:
+         (uint16(0) == 0x5a4d and 3 of them) or (5 of them)
+}