Malware DRAIN function siphoning crypto wallet balances via DRAIN_PCT

Emiliano Mema@Nosalva

•updated Aug 12, 2026•1•0•4

This rule detects the execution of scripts or processes containing command-line arguments indicative of a cryptocurrency wallet drainer (e.g., 'DRAIN', 'DRAIN_PCT') targeting specific cryptocurrencies (bitcoin, ethereum, etc.). These scripts are commonly used by threat actors to exfiltrate funds from victim crypto wallets.