import "hash"

rule bulwark_https_bulwarkblack_com_ahsaycbs_webshell_miner_backup_server_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ahsaycbs-webshell-miner-backup-server-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-12T01:04:36Z"
        tlp = "TLP:CLEAR"
        indicator_count = "19"
    strings:
        $s0 = "aliyuncs.com" ascii wide nocase  // Domains
        $s1 = "imagefiles-backup.oss-ap-southeast-7.aliyuncs.com" ascii wide nocase  // Domains
        $s2 = "xmr.kryptex.network" ascii wide nocase  // Domains
        $s3 = "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com" ascii wide nocase  // URLs
        $s4 = "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1" ascii wide nocase  // URLs
        $s5 = "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys" ascii wide nocase  // URLs
        $s6 = "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json" ascii wide nocase  // URLs
        $s7 = "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe" ascii wide nocase  // URLs
        $s8 = "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe" ascii wide nocase  // URLs
        $s9 = "104.234.26.10" ascii wide nocase  // IPv4
        $s10 = "107.191.47.199" ascii wide nocase  // IPv4
        $s11 = "123.202.208.37" ascii wide nocase  // IPv4
        $s12 = "177.4.12.11" ascii wide nocase  // IPv4
        $s13 = "185.220.236.49" ascii wide nocase  // IPv4
        $s14 = "38.60.252.110" ascii wide nocase  // IPv4
        $s15 = "51.195.127.124" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034" or
        hash.sha256(0, filesize) == "481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21" or
        hash.sha256(0, filesize) == "4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d"
}