import "hash"

rule bulwark_https_bulwarkblack_com_dragonforce_turn_mqtt_backdoors_egress_visibility
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/dragonforce-turn-mqtt-backdoors-egress-visibility/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-01T20:04:13Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "printpro.com" ascii wide nocase  // Domains
        $s1 = "whapido.com" ascii wide nocase  // Domains
        $s2 = "http://188.190.4.111/25vtps.txt" ascii wide nocase  // URLs
        $s3 = "http://188.190.4.111/dldwuibjn_chShllcodeTrn.txt" ascii wide nocase  // URLs
        $s4 = "188.190.4.111" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "01d638ddd9d780e934305422bc9ee8fa3a5b3163ba66514ae5e5a34ff24df9db" or
        hash.sha256(0, filesize) == "1657b22a553feae422dab77886ac60c06b8fad7cbd2cfaf482ba9066ba9922be" or
        hash.sha256(0, filesize) == "5275579f539812ff66d060e12c9b7e99a22c625018f1aae9c5642ab0ba058ccb" or
        hash.sha256(0, filesize) == "6bbf10bcbef7ac5102b54c81137859891a3802dbacd888be90f990d50e18b0b4" or
        hash.sha256(0, filesize) == "c91852bfb8f1d428875595c14cfada8fb234483adb8c6ba78ca2b5ae2a0683e2" or
        hash.sha256(0, filesize) == "e9cd052f2d9514d40235ec04c9592f4274d0a4161b846e59bbb5a1a2c806a1c5" or
        hash.sha256(0, filesize) == "f8eabae53e9dc8c529b6e38c58040ff28a07728cb5e896e16fb64e84bed5cd88"
}