import "hash"

rule bulwark_https_bulwarkblack_com_cikabika_discord_rat_document_lure_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/cikabika-discord-rat-document-lure-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-18T20:03:26Z"
        tlp = "TLP:CLEAR"
        indicator_count = "23"
    strings:
        $s0 = "bduwih8.pro" ascii wide nocase  // Domains
        $s1 = "citcix6.xyz" ascii wide nocase  // Domains
        $s2 = "donate.ssl.xmrig.com" ascii wide nocase  // Domains
        $s3 = "google.services.ug" ascii wide nocase  // Domains
        $s4 = "haveibeensquatted.com" ascii wide nocase  // Domains
        $s5 = "hf98x4d.site" ascii wide nocase  // Domains
        $s6 = "ipify.com" ascii wide nocase  // Domains
        $s7 = "onedrive.cv" ascii wide nocase  // Domains
        $s8 = "polygon.drpc.org" ascii wide nocase  // Domains
        $s9 = "pool.hashvault.pro" ascii wide nocase  // Domains
        $s10 = "release-assets.githubusercontent.com" ascii wide nocase  // Domains
        $s11 = "sj98xe4.xyz" ascii wide nocase  // Domains
        $s12 = "http://onedrive.cv/Downloads/CURP/ReportFinal.%E2%80%AE%E1%BA%9D%D4%81%EF%BD%90.scr" ascii wide nocase  // URLs
        $s13 = "https://haveibeensquatted.com/blog/from-typosquatting-to-macos-backdoor-clickfix-blockchain-c2" ascii wide nocase  // URLs
        $s14 = "138.124.123.87" ascii wide nocase  // IPv4
        $s15 = "192.229.115.229" ascii wide nocase  // IPv4
        $s16 = "195.242.214.34" ascii wide nocase  // IPv4
        $s17 = "77.110.127.205" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "2deb724a709b0b892248405323350e9b" or
        hash.md5(0, filesize) == "62e3e85eca78a0cd7e6669e9f33d936d" or
        hash.md5(0, filesize) == "c66858718d883bcfb9ce2c19b59f96c9" or
        hash.md5(0, filesize) == "eeb52cb95113a131c2c7713c17872da6" or
        hash.sha256(0, filesize) == "b0e5c51a411065864119c305fddf218b7c120731f655932cc1c3307ad5b43f94"
}