import "hash"

rule bulwark_https_bulwarkblack_com_fake_clawdbot_vs_code_extension_deploys_screenconnect_rat
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fake-clawdbot-vs-code-extension-deploys-screenconnect-rat/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:23:52Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "bulletmailer.net" ascii wide nocase  // Domains
        $s1 = "clawdbot.getintwopc.site" ascii wide nocase  // Domains
        $s2 = "darkgptprivate.com" ascii wide nocase  // Domains
        $s3 = "dropbox.com" ascii wide nocase  // Domains
        $s4 = "getintwopc.site" ascii wide nocase  // Domains
        $s5 = "meeting.bulletmailer.net" ascii wide nocase  // Domains
        $s6 = "www.aikido.dev" ascii wide nocase  // Domains
        $s7 = "www.dropbox.com" ascii wide nocase  // Domains
        $s8 = "http://clawdbot.getintwopc.site/config.json&#x27" ascii wide nocase  // URLs
        $s9 = "http://clawdbot.getintwopc.site/dl/Lightshot.dll&#x27" ascii wide nocase  // URLs
        $s10 = "http://clawdbot.getintwopc.site/dl/Lightshot.exe&#x27" ascii wide nocase  // URLs
        $s11 = "https://darkgptprivate.com/d111&quot" ascii wide nocase  // URLs
        $s12 = "https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware" ascii wide nocase  // URLs
        $s13 = "https://www.dropbox.com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate.msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1" ascii wide nocase  // URLs
        $s14 = "178.16.54.253" ascii wide nocase  // IPv4
        $s15 = "179.43.176.32" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "04ef48b104d6ebd05ad70f6685ade26c1905495456f52dfe0fb42f550bd43388" or
        hash.sha256(0, filesize) == "adbcdb613c04fd51936cb0863d2417604db0cd04792ab7cae02526d48944c77b" or
        hash.sha256(0, filesize) == "d1e0c26774cb8beabaf64f119652719f673fb530368d5b2166178191ad5fcbea" or
        hash.sha256(0, filesize) == "e20b920c7af988aa215c95bbaa365d005dd673544ab7e3577b60fecf11dcdea2"
}