Update cryptopools.py

CAPESandbox · Jun 3, 2024 · e13edd2 · e13edd2
1 parent 2906408
commit e13edd2
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/modules/signatures/windows/cryptopools.py b/modules/signatures/windows/cryptopools.py
@@ -1,3 +1,4 @@
+import re
 from lib.cuckoo.common.abstracts import Signature
 
 from data.cryptopools import pool_domains
@@ -33,7 +34,7 @@ def on_complete(self):
             self.extra_domains += domains
 
         for domain in self.extra_domains:
-            if domain in pool_domains or self.check_executed_command(pattern=domain, regex=True):
+            if domain in pool_domains or any([re.match(pool_domain, domain) for pool_domain in pool_domains]) or self.check_executed_command(pattern=domain, regex=True):
                 self.malfamily = "crypto miner"
                 self.results["malfamily"] = "crypto miner"
                 self.results["malfamily_tag"] = "Behavior"