import "hash"

rule bulwark_https_bulwarkblack_com_flutterbridge_macos_malvertising_fluttershell_backdoor_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/flutterbridge-macos-malvertising-fluttershell-backdoor-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "26"
    strings:
        $s0 = "ads-parkpro.com" ascii wide nocase  // Domains
        $s1 = "adsparkpro.net" ascii wide nocase  // Domains
        $s2 = "adsparkpro.top" ascii wide nocase  // Domains
        $s3 = "atsheisdomestic.org" ascii wide nocase  // Domains
        $s4 = "com.app" ascii wide nocase  // Domains
        $s5 = "com.pdfninja.app" ascii wide nocase  // Domains
        $s6 = "dart.dev" ascii wide nocase  // Domains
        $s7 = "etoftheappyrince.org" ascii wide nocase  // Domains
        $s8 = "flutter.dev" ascii wide nocase  // Domains
        $s9 = "healightejustb.org" ascii wide nocase  // Domains
        $s10 = "pdf-brain.app" ascii wide nocase  // Domains
        $s11 = "pdf-ninja.app" ascii wide nocase  // Domains
        $s12 = "sinterfumesco.com" ascii wide nocase  // Domains
        $s13 = "sparkle-project.org" ascii wide nocase  // Domains
        $s14 = "https://atsheisdomestic.org/update-thanks.html" ascii wide nocase  // URLs
        $s15 = "https://etoftheappyrince.org/update-delay" ascii wide nocase  // URLs
        $s16 = "https://healightejustb.org/checkupdateTO.js" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b845" or
        hash.sha256(0, filesize) == "30448686ec900d5213d74f08f0d2b7924c5336a29445b2a434aba8d8b19d7530" or
        hash.sha256(0, filesize) == "363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc34" or
        hash.sha256(0, filesize) == "48047c34bbd57fe1e24bc538bc2ce9e0ac4c4eb48d3b0c195b414f0379dc0745" or
        hash.sha256(0, filesize) == "644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e70" or
        hash.sha256(0, filesize) == "8421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b2533109" or
        hash.sha256(0, filesize) == "9053e8ddaecca1f960c041c944ca8799fc71dc86a4b50d2639ee4e0d2cb82f47" or
        hash.sha256(0, filesize) == "9425e8e39fa8a7212cdd07f0917cb3dfde38a90b87297de2c82a5850aff1e4de" or
        hash.sha256(0, filesize) == "b60074d1ea2008a581f432f2dee5f84f78668d9dd8e66f75d03c42dabd89bdea"
}