import "hash"

rule bulwark_https_bulwarkblack_com_cl_sta_1062_tinyrct_critical_infrastructure_web_shell_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/cl-sta-1062-tinyrct-critical-infrastructure-web-shell-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "18"
    strings:
        $s0 = "http://139.180.134.221/PerfWatson2.exe" ascii wide nocase  // URLs
        $s1 = "http://139.180.134.221/sdksdk608/1.zip" ascii wide nocase  // URLs
        $s2 = "http://139.180.134.221/sdksdk608/anydesk%5f0117.zip" ascii wide nocase  // URLs
        $s3 = "http://139.180.134.221/sdksdk608/hamcore.se2" ascii wide nocase  // URLs
        $s4 = "http://139.180.134.221/sdksdk608/httpdf" ascii wide nocase  // URLs
        $s5 = "http://139.180.134.221/sdksdk608/hxxpdf" ascii wide nocase  // URLs
        $s6 = "http://139.180.134.221/sdksdk608/vpn%5fbridge.config" ascii wide nocase  // URLs
        $s7 = "http://139.180.134.221/sdksdk608/win-vpn.rar" ascii wide nocase  // URLs
        $s8 = "139.180.134.221" ascii wide nocase  // IPv4
        $s9 = "202.182.102.5" ascii wide nocase  // IPv4
        $s10 = "45.32.113.172" ascii wide nocase  // IPv4
        $s11 = "45.76.210.43" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c" or
        hash.sha256(0, filesize) == "4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384" or
        hash.sha256(0, filesize) == "9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472" or
        hash.sha256(0, filesize) == "cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3" or
        hash.sha256(0, filesize) == "dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b" or
        hash.sha256(0, filesize) == "f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1"
}