import "hash"

rule bulwark_https_bulwarkblack_com_aeternum_blockchain_c2_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/aeternum-blockchain-c2-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "49"
    strings:
        $s0 = "api.noderpc.xyz" ascii wide nocase  // Domains
        $s1 = "api.zan.top" ascii wide nocase  // Domains
        $s2 = "constant-path.xyz" ascii wide nocase  // Domains
        $s3 = "download.sftp-api-group-wechat.com" ascii wide nocase  // Domains
        $s4 = "duckdns.org" ascii wide nocase  // Domains
        $s5 = "endpoints.omniatech.io" ascii wide nocase  // Domains
        $s6 = "gateway.tenderly.co" ascii wide nocase  // Domains
        $s7 = "hypersync.xyz" ascii wide nocase  // Domains
        $s8 = "noderpc.xyz" ascii wide nocase  // Domains
        $s9 = "nodies.app" ascii wide nocase  // Domains
        $s10 = "polygon-amoy.gateway.tenderly.co" ascii wide nocase  // Domains
        $s11 = "polygon-amoy.therpc.io" ascii wide nocase  // Domains
        $s12 = "polygon-mumbai-bor-rpc.publicnode.com" ascii wide nocase  // Domains
        $s13 = "polygon-mumbai.gateway.tenderly.co" ascii wide nocase  // Domains
        $s14 = "polygon-pokt.nodies.app" ascii wide nocase  // Domains
        $s15 = "polygon-zkevm-mainnet.public.blastapi.io" ascii wide nocase  // Domains
        $s16 = "polygon-zkevm.drpc.org" ascii wide nocase  // Domains
        $s17 = "polygon.rpc.hypersync.xyz" ascii wide nocase  // Domains
        $s18 = "polygontestapi.terminet.io" ascii wide nocase  // Domains
        $s19 = "rpc.polygon-zkevm.gateway.fm" ascii wide nocase  // Domains
        $s20 = "rpc.polygonsupernet.public.arianee.net" ascii wide nocase  // Domains
        $s21 = "sekirolegion.duckdns.org" ascii wide nocase  // Domains
        $s22 = "sftp-api-group-wechat.com" ascii wide nocase  // Domains
        $s23 = "update-launcher.xyz" ascii wide nocase  // Domains
        $s24 = "update.constant-path.xyz" ascii wide nocase  // Domains
        $s25 = "http://sekirolegion.duckdns.org/api/endpoint.php" ascii wide nocase  // URLs
        $s26 = "https://api.noderpc.xyz/rpc-polygon-pos/public" ascii wide nocase  // URLs
        $s27 = "https://api.zan.top/polygon-amoy" ascii wide nocase  // URLs
        $s28 = "https://endpoints.omniatech.io/v1/polygon-zkevm/testnet/public" ascii wide nocase  // URLs
        $s29 = "https://gateway.tenderly.co/public/polygon" ascii wide nocase  // URLs
        $s30 = "https://gateway.tenderly.co/public/polygon-mumbai" ascii wide nocase  // URLs
        $s31 = "https://polygon-amoy.gateway.tenderly.co" ascii wide nocase  // URLs
        $s32 = "https://polygon-amoy.therpc.io" ascii wide nocase  // URLs
        $s33 = "https://polygon-mumbai-bor-rpc.publicnode.com" ascii wide nocase  // URLs
        $s34 = "https://polygon-mumbai.gateway.tenderly.co" ascii wide nocase  // URLs
        $s35 = "https://polygon-pokt.nodies.app/" ascii wide nocase  // URLs
        $s36 = "https://polygon-zkevm-mainnet.public.blastapi.io" ascii wide nocase  // URLs
        $s37 = "https://polygon-zkevm.drpc.org" ascii wide nocase  // URLs
        $s38 = "https://polygon.rpc.hypersync.xyz/" ascii wide nocase  // URLs
        $s39 = "https://polygontestapi.terminet.io/rpc" ascii wide nocase  // URLs
        $s40 = "https://rpc.polygon-zkevm.gateway.fm" ascii wide nocase  // URLs
        $s41 = "https://rpc.polygonsupernet.public.arianee.net" ascii wide nocase  // URLs
        $s42 = "193.221.200.219" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505" or
        hash.sha256(0, filesize) == "4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f" or
        hash.sha256(0, filesize) == "5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898" or
        hash.sha256(0, filesize) == "81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f" or
        hash.sha256(0, filesize) == "ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2" or
        hash.sha256(0, filesize) == "f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27"
}