import "hash"

rule bulwark_https_bulwarkblack_com_cl_sta_1087_chinese_apt_targets_southeast_asian_militaries_with_a
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/cl-sta-1087-chinese-apt-targets-southeast-asian-militaries-with-applechris-and-memfun-backdoors/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "17"
    strings:
        $s0 = "109.248.24.177" ascii wide nocase  // IPv4
        $s1 = "116.63.177.49" ascii wide nocase  // IPv4
        $s2 = "118.194.238.51" ascii wide nocase  // IPv4
        $s3 = "154.39.137.203" ascii wide nocase  // IPv4
        $s4 = "154.39.142.177" ascii wide nocase  // IPv4
        $s5 = "8.212.169.27" ascii wide nocase  // IPv4
        $s6 = "8.220.135.151" ascii wide nocase  // IPv4
        $s7 = "8.220.177.252" ascii wide nocase  // IPv4
        $s8 = "8.220.184.177" ascii wide nocase  // IPv4
        $s9 = "0XFEXYCDAPPLE05CHRIS" ascii wide nocase  // Mutex Names
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0e255b4b04f5064ff97da214050da81a823b3d99bce60cdd9ee90d913cc4a952" or
        hash.sha256(0, filesize) == "2ee667c0ddd4aa341adf8d85b54fbb2fce8cc14aa88967a5cb99babb08a10fae" or
        hash.sha256(0, filesize) == "413daa580db74a38397d09979090b291f916f0bb26a68e7e0b03b4390c1b472f" or
        hash.sha256(0, filesize) == "5a6ba08efcef32f5f38df544c319d1983adc35f3db64f77fa5b51b44d0e5052c" or
        hash.sha256(0, filesize) == "9e44a460196cc92fa6c6c8a12d74fb73a55955045733719e3966a7b8ced6c500" or
        hash.sha256(0, filesize) == "ad25b40315dad0bda5916854e1925c1514f8f8b94e4ee09a43375cc1e77422ad" or
        hash.sha256(0, filesize) == "ee4d4b7340b3fa70387050cd139b43ecc65d0cfd9e3c7dcb94562f5c9c91f58f"
}