// Selected evidence-qualified indicators only; not the complete article IOC inventory.
// Source context is not a confirmed-malicious verdict; verify before operational use.
import "hash"

rule bulwark_https_bulwarkblack_com_fake_download_inno_installers_whole_session_investigation
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fake-download-inno-installers-whole-session-investigation/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-11-03T21:03:09Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "beliefdesk.xyz" ascii wide nocase  // Domains
        $s1 = "companyharbor.xyz" ascii wide nocase  // Domains
        $s2 = "inkact.xyz" ascii wide nocase  // Domains
        $s3 = "signalpane.cfd" ascii wide nocase  // Domains
        $s4 = "wishgrove.cfd" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c" or
        hash.sha256(0, filesize) == "21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044" or
        hash.sha256(0, filesize) == "452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0" or
        hash.sha256(0, filesize) == "523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152" or
        hash.sha256(0, filesize) == "55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f" or
        hash.sha256(0, filesize) == "72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70" or
        hash.sha256(0, filesize) == "ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f"
}