import "hash"

rule bulwark_https_bulwarkblack_com_apt37_deploys_ruby_jumper_campaign_to_breach_air_gapped_networks
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/apt37-deploys-ruby-jumper-campaign-to-breach-air-gapped-networks/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:23:01Z"
        tlp = "TLP:CLEAR"
        indicator_count = "19"
    strings:
        $s0 = "hightkdhe.store" ascii wide nocase  // Domains
        $s1 = "homeatedke.store" ascii wide nocase  // Domains
        $s2 = "philion.store" ascii wide nocase  // Domains
        $s3 = "www.hightkdhe.store" ascii wide nocase  // Domains
        $s4 = "www.homeatedke.store" ascii wide nocase  // Domains
        $s5 = "www.philion.store" ascii wide nocase  // Domains
        $s6 = "https://www.hightkdhe.store/star/main.php" ascii wide nocase  // URLs
        $s7 = "https://www.homeatedke.store/star/main.php" ascii wide nocase  // URLs
        $s8 = "https://www.philion.store/star/main.php" ascii wide nocase  // URLs
        $s9 = "144.172.106.66" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "098d697f29b94c11b52c51bfe8f9c47d" or
        hash.md5(0, filesize) == "4214818d7cde26ebeb4f35bc2fc29ada" or
        hash.md5(0, filesize) == "476bce9b9a387c5f39461d781e7e22b9" or
        hash.md5(0, filesize) == "57dac5f7d21da2454d0fbefdced80bf3" or
        hash.md5(0, filesize) == "585322a931a49f4e1d78fb0b3f3c6212" or
        hash.md5(0, filesize) == "5c6ff601ccc75e76c2fc99808d8cc9a9" or
        hash.md5(0, filesize) == "709d70239f1e9441e8e21fcacfdc5d08" or
        hash.md5(0, filesize) == "ad556f4eb48e7dba6da14444dcce3170" or
        hash.md5(0, filesize) == "ed54cf1ebffbfc1c8ae1ccdd2c681012"
}