I believe the drainer you are trying to detect with this PR and #248 is called Inferno Drainer.
I have created a rule to capture this, please let me know if you are okay with it.

title: Inferno Drainer f07c5ddf
description: |
   Sites that match these signatures tend to host a crypto
   drainer. Which acts when a victim approves a transaction 
   via the phishing website.
references:
    - https://urlscan.io/result/f07c5ddf-59cc-4131-9865-16f297918f2d
    - https://urlscan.io/result/57688f6f-3437-405e-915a-787ac8cb19df
    - https://urlscan.io/result/0cceace4-7aae-45ff-9e58-6da75e3c3220

detection:

  drainerFile:
    requests|re: '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}.js'

  obfuscationSignature:
    js|contains: 'var __p_'
    
  condition: drainerFile and obfuscationSignature

Yes, that is fine

I believe the drainer you are trying to detect with this PR and #248 is called Inferno Drainer. I have created a rule to capture this, please let me know if you are okay with it.

title: Inferno Drainer f07c5ddf
description: |
   Sites that match these signatures tend to host a crypto
   drainer. Which acts when a victim approves a transaction 
   via the phishing website.
references:
    - https://urlscan.io/result/f07c5ddf-59cc-4131-9865-16f297918f2d
    - https://urlscan.io/result/57688f6f-3437-405e-915a-787ac8cb19df
    - https://urlscan.io/result/0cceace4-7aae-45ff-9e58-6da75e3c3220

detection:

  drainerFile:
    requests|re: '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}.js'

  obfuscationSignature:
    js|contains: 'var __p_'
    
  condition: drainerFile and obfuscationSignature

Yes, that is fine.

Yes, that is fine

I believe the drainer you are trying to detect with this PR and #248 is called Inferno Drainer. I have created a rule to capture this, please let me know if you are okay with it.

title: Inferno Drainer f07c5ddf
description: |
   Sites that match these signatures tend to host a crypto
   drainer. Which acts when a victim approves a transaction 
   via the phishing website.
references:
    - https://urlscan.io/result/f07c5ddf-59cc-4131-9865-16f297918f2d
    - https://urlscan.io/result/57688f6f-3437-405e-915a-787ac8cb19df
    - https://urlscan.io/result/0cceace4-7aae-45ff-9e58-6da75e3c3220

detection:

  drainerFile:
    requests|re: '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}.js'

  obfuscationSignature:
    js|contains: 'var __p_'
    
  condition: drainerFile and obfuscationSignature

Yes, that is fine.

Okay, lets make a PR with that rule and then merge it. That way we can catch both #247 and #248.