import "hash"

rule bulwark_https_bulwarkblack_com_android_malware_campaign_abuses_hugging_face_ai_platform_to_distr
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/android-malware-campaign-abuses-hugging-face-ai-platform-to-distribute-rat/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "23"
    strings:
        $s0 = "au-club.top" ascii wide nocase  // Domains
        $s1 = "cdn-lfs-us-1.hf.co" ascii wide nocase  // Domains
        $s2 = "hf.co" ascii wide nocase  // Domains
        $s3 = "huggingface.co" ascii wide nocase  // Domains
        $s4 = "trustbastion.com" ascii wide nocase  // Domains
        $s5 = "www.trustbastion.com" ascii wide nocase  // Domains
        $s6 = "https://cdn-lfs-us-1.hf.co/r" ascii wide nocase  // URLs
        $s7 = "https://huggingface.co" ascii wide nocase  // URLs
        $s8 = "https://huggingface.co/datasets/xcvqsccm/sfxyt851/resolve/main/b.apk?download=true" ascii wide nocase  // URLs
        $s9 = "https://www.trustbastion.com/xiazz.html" ascii wide nocase  // URLs
        $s10 = "108.187.7.133" ascii wide nocase  // IPv4
        $s11 = "143.204.11.112" ascii wide nocase  // IPv4
        $s12 = "148.135.44.146" ascii wide nocase  // IPv4
        $s13 = "154.198.48.57" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "15bdc66aca9fb7290165d460e6a993a9" or
        hash.md5(0, filesize) == "b62c906078644edd3439e2d986abd2e2" or
        hash.md5(0, filesize) == "b716a8a742fec3084b0f497abbfecfc0" or
        hash.md5(0, filesize) == "d184d705189e42b54c6243a55d6c9502" or
        hash.md5(0, filesize) == "d8b0fd515d860be2969cf441ea3b620d" or
        hash.md5(0, filesize) == "fc874c42ea76dd5f867649cbdf81e39b" or
        hash.sha1(0, filesize) == "bdf3779ddc10f241603be57a90865b680cde8c31" or
        hash.sha256(0, filesize) == "19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36" or
        hash.sha256(0, filesize) == "a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72"
}