import "hash"

rule bulwark_https_bulwarkblack_com_bing_seo_poisoning_bumblebee_adaptix_akira_ransomware
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/bing-seo-poisoning-bumblebee-adaptix-akira-ransomware/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "49"
    strings:
        $s0 = "2rxyt8yrhq0bgj.org" ascii wide nocase  // Domains
        $s1 = "2rxyt9urhq0bgj.org" ascii wide nocase  // Domains
        $s2 = "5ka8rxp6t6eup2.org" ascii wide nocase  // Domains
        $s3 = "6cimu4mc085em8.org" ascii wide nocase  // Domains
        $s4 = "8doj8uvx604eck.org" ascii wide nocase  // Domains
        $s5 = "certgraveyard.org" ascii wide nocase  // Domains
        $s6 = "d1hmxkpwby0d4s.org" ascii wide nocase  // Domains
        $s7 = "delete.me" ascii wide nocase  // Domains
        $s8 = "download-center.online" ascii wide nocase  // Domains
        $s9 = "download-server.online" ascii wide nocase  // Domains
        $s10 = "ev2sirbd269o5j.org" ascii wide nocase  // Domains
        $s11 = "ewujsfb1dp5ran.org" ascii wide nocase  // Domains
        $s12 = "ip-scanner.org" ascii wide nocase  // Domains
        $s13 = "ks501oz9nm3v05.org" ascii wide nocase  // Domains
        $s14 = "kwywztxoo2xdot.org" ascii wide nocase  // Domains
        $s15 = "ky1d1p1daahe5t.org" ascii wide nocase  // Domains
        $s16 = "netml.shop" ascii wide nocase  // Domains
        $s17 = "opmanager.pro" ascii wide nocase  // Domains
        $s18 = "ovh1kn1tcqw5kp.org" ascii wide nocase  // Domains
        $s19 = "shopping5.shop" ascii wide nocase  // Domains
        $s20 = "sigmasearchengine.com" ascii wide nocase  // Domains
        $s21 = "soft-hub.pro" ascii wide nocase  // Domains
        $s22 = "soft-server.online" ascii wide nocase  // Domains
        $s23 = "tria.ge" ascii wide nocase  // Domains
        $s24 = "v5rjsdqogstopr.org" ascii wide nocase  // Domains
        $s25 = "yj6jurm5qqkye5.org" ascii wide nocase  // Domains
        $s26 = "zenmap.pro" ascii wide nocase  // Domains
        $s27 = "https://tria.ge/250530-ttmjhayzhw" ascii wide nocase  // URLs
        $s28 = "https://tria.ge/250812-zw4tfszpy4" ascii wide nocase  // URLs
        $s29 = "109.205.195.211" ascii wide nocase  // IPv4
        $s30 = "170.130.55.223" ascii wide nocase  // IPv4
        $s31 = "171.22.183.43" ascii wide nocase  // IPv4
        $s32 = "172.96.137.160" ascii wide nocase  // IPv4
        $s33 = "185.174.100.203" ascii wide nocase  // IPv4
        $s34 = "188.40.187.145" ascii wide nocase  // IPv4
        $s35 = "192.121.22.94" ascii wide nocase  // IPv4
        $s36 = "193.242.184.150" ascii wide nocase  // IPv4
        $s37 = "194.127.178.21" ascii wide nocase  // IPv4
        $s38 = "4.239.95.1" ascii wide nocase  // IPv4
        $s39 = "84.32.84.32" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "124a48b78060fa851e1cc077ca35713c" or
        hash.md5(0, filesize) == "8c113b3aa82c81eee7c6b4ed0ba9a90f" or
        hash.md5(0, filesize) == "ca8646dfc88423bb9fffda811160cebe" or
        hash.sha1(0, filesize) == "ab82bf27132323861810c0efcac6d5dd01600dd4" or
        hash.sha1(0, filesize) == "d66944e1a57daf04d3e809f22cd01946d593acaf" or
        hash.sha1(0, filesize) == "febbaf5f08a8e0782ffcce8beef1f2b4e249a52b" or
        hash.sha256(0, filesize) == "186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da" or
        hash.sha256(0, filesize) == "a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331" or
        hash.sha256(0, filesize) == "de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d"
}