import "hash"

rule bulwark_https_bulwarkblack_com_deceptive_cracked_software_spreads_lumma_variant_on_youtube
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/deceptive-cracked-software-spreads-lumma-variant-on-youtube/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "15"
    strings:
        $s0 = "chincenterblandwka.pw" ascii wide nocase  // Domains
        $s1 = "cutt.ly" ascii wide nocase  // Domains
        $s2 = "netovrema.pw" ascii wide nocase  // Domains
        $s3 = "opposesicknessopw.pw" ascii wide nocase  // Domains
        $s4 = "politefrightenpowoa.pw" ascii wide nocase  // Domains
        $s5 = "http://cutt.ly/lwD7B7lp" ascii wide nocase  // URLs
        $s6 = "176.113.115.224" ascii wide nocase  // IPv4
        $s7 = "176.113.115.226" ascii wide nocase  // IPv4
        $s8 = "176.113.115.227" ascii wide nocase  // IPv4
        $s9 = "176.113.115.229" ascii wide nocase  // IPv4
        $s10 = "176.113.115.232" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "01a23f8f59455eb97f55086c21be934e6e5db07e64acb6e63c8d358b763dab4f" or
        hash.sha256(0, filesize) == "483672a00ea676236ea423c91d576542dc572be864a4162df031faf35897a532" or
        hash.sha256(0, filesize) == "48cbeb1b1ca0a7b3a9f6ac56273fbaf85e78c534e26fb2bca1152ecd7542af54" or
        hash.sha256(0, filesize) == "7603c6dd9edca615d6dc3599970c203555b57e2cab208d87545188b57aa2c6b1"
}