import "hash"

rule bulwark_https_bulwarkblack_com_blinder_tunnel_developer_lures_critical_infrastructure
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/blinder-tunnel-developer-lures-critical-infrastructure/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-06T15:05:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "24"
    strings:
        $s0 = "asdfafadafg.online" ascii wide nocase  // Domains
        $s1 = "cloud.g-drive.cam" ascii wide nocase  // Domains
        $s2 = "drivegoogel.cam" ascii wide nocase  // Domains
        $s3 = "g-drive.cam" ascii wide nocase  // Domains
        $s4 = "googeldrive.cam" ascii wide nocase  // Domains
        $s5 = "googelmeet.online" ascii wide nocase  // Domains
        $s6 = "meetonline.cam" ascii wide nocase  // Domains
        $s7 = "musicdel.ir" ascii wide nocase  // Domains
        $s8 = "ns1.soroshpasargad.com" ascii wide nocase  // Domains
        $s9 = "portal.sharjahairport.cloud" ascii wide nocase  // Domains
        $s10 = "https://github.com/GreenBeret0" ascii wide nocase  // URLs
        $s11 = "https://github.com/peakyblinders-tm" ascii wide nocase  // URLs
        $s12 = "38.180.136.127" ascii wide nocase  // IPv4
        $s13 = "65.109.214.145" ascii wide nocase  // IPv4
        $s14 = "87.248.129.239" ascii wide nocase  // IPv4
        $s15 = "91.107.156.29" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13" or
        hash.sha256(0, filesize) == "53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402" or
        hash.sha256(0, filesize) == "6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239" or
        hash.sha256(0, filesize) == "76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e" or
        hash.sha256(0, filesize) == "7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875" or
        hash.sha256(0, filesize) == "d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260" or
        hash.sha256(0, filesize) == "f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9" or
        hash.sha256(0, filesize) == "f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd"
}