import "hash"

rule bulwark_https_bulwarkblack_com_fake_github_rapuncel_infostealer_download_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fake-github-rapuncel-infostealer-download-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-20T01:05:31Z"
        tlp = "TLP:CLEAR"
        indicator_count = "25"
    strings:
        $s0 = "albinofennel.com" ascii wide nocase  // Domains
        $s1 = "awwwards.com" ascii wide nocase  // Domains
        $s2 = "dallikilic54.github.io" ascii wide nocase  // Domains
        $s3 = "edgarcostartqd.github.io" ascii wide nocase  // Domains
        $s4 = "hanselarinmusky.com" ascii wide nocase  // Domains
        $s5 = "icansamyope.com" ascii wide nocase  // Domains
        $s6 = "istatlmenus.com" ascii wide nocase  // Domains
        $s7 = "lastpass-authenticator.github.io" ascii wide nocase  // Domains
        $s8 = "lastpass.com" ascii wide nocase  // Domains
        $s9 = "macperformancetools.com" ascii wide nocase  // Domains
        $s10 = "ryanpresbrey.cc" ascii wide nocase  // Domains
        $s11 = "threads.com" ascii wide nocase  // Domains
        $s12 = "zaffersnouty.com" ascii wide nocase  // Domains
        $s13 = "104.21.18.89" ascii wide nocase  // IPv4
        $s14 = "104.21.20.224" ascii wide nocase  // IPv4
        $s15 = "104.21.27.38" ascii wide nocase  // IPv4
        $s16 = "172.67.168.224" ascii wide nocase  // IPv4
        $s17 = "172.67.212.253" ascii wide nocase  // IPv4
        $s18 = "2.26.126.50" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "1e6c1766ac78d7adfdae71d361cb132d972771897ae9065503b135cb812d7c35" or
        hash.sha256(0, filesize) == "26db14b956e33f69b3397a36387d32e01eb63613acff91069dc76b6ed7de45a8" or
        hash.sha256(0, filesize) == "611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61" or
        hash.sha256(0, filesize) == "75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40" or
        hash.sha256(0, filesize) == "aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd" or
        hash.sha256(0, filesize) == "ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6"
}