import "hash"

rule bulwark_https_bulwarkblack_com_c2looper_github_c2_ransomware_triage
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/c2looper-github-c2-ransomware-triage/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-17T15:07:50Z"
        tlp = "TLP:CLEAR"
        indicator_count = "5"
    strings:
        $s0 = "45.158.196.184" ascii wide nocase  // IPv4
        $s1 = "45.158.196.23" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549" or
        hash.sha256(0, filesize) == "f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6" or
        hash.sha256(0, filesize) == "f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b"
}