import "hash"

rule bulwark_https_bulwarkblack_com_fake_7_zip_downloads_convert_home_pcs_into_residential_proxy_node
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fake-7-zip-downloads-convert-home-pcs-into-residential-proxy-nodes-for-cybercriminals/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "35"
    strings:
        $s0 = "7-zip.org" ascii wide nocase  // Domains
        $s1 = "7zip.com" ascii wide nocase  // Domains
        $s2 = "apex.herosms.ai" ascii wide nocase  // Domains
        $s3 = "flux.smshero.co" ascii wide nocase  // Domains
        $s4 = "glide.smshero.cc" ascii wide nocase  // Domains
        $s5 = "hero-sms.ai" ascii wide nocase  // Domains
        $s6 = "hero-sms.co" ascii wide nocase  // Domains
        $s7 = "herosms.ai" ascii wide nocase  // Domains
        $s8 = "herosms.cc" ascii wide nocase  // Domains
        $s9 = "herosms.co" ascii wide nocase  // Domains
        $s10 = "herosms.io" ascii wide nocase  // Domains
        $s11 = "herosms.vip" ascii wide nocase  // Domains
        $s12 = "iplogger.org" ascii wide nocase  // Domains
        $s13 = "mint.smshero.com" ascii wide nocase  // Domains
        $s14 = "neo.herosms.co" ascii wide nocase  // Domains
        $s15 = "nova.smshero.ai" ascii wide nocase  // Domains
        $s16 = "prime.herosms.vip" ascii wide nocase  // Domains
        $s17 = "pulse.herosms.cc" ascii wide nocase  // Domains
        $s18 = "smshero.ai" ascii wide nocase  // Domains
        $s19 = "smshero.cc" ascii wide nocase  // Domains
        $s20 = "smshero.co" ascii wide nocase  // Domains
        $s21 = "smshero.com" ascii wide nocase  // Domains
        $s22 = "smshero.vip" ascii wide nocase  // Domains
        $s23 = "soc.hero-sms.co" ascii wide nocase  // Domains
        $s24 = "spark.herosms.io" ascii wide nocase  // Domains
        $s25 = "update.7zip.com" ascii wide nocase  // Domains
        $s26 = "vivid.smshero.vip" ascii wide nocase  // Domains
        $s27 = "zest.hero-sms.ai" ascii wide nocase  // Domains
        $s28 = "1.0.0.2" ascii wide nocase  // IPv4
        $s29 = "104.21.57.71" ascii wide nocase  // IPv4
        $s30 = "172.67.160.241" ascii wide nocase  // IPv4
        $s31 = "Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7" ascii wide nocase  // Mutex Names
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9" or
        hash.sha256(0, filesize) == "b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894" or
        hash.sha256(0, filesize) == "e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027"
}