import "hash"

rule bulwark_https_bulwarkblack_com_forticlient_ems_ekz_infostealer_delivery
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/forticlient-ems-ekz-infostealer-delivery/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "13"
    strings:
        $s0 = "http://83.138.53.110/dl/p.exe" ascii wide nocase  // URLs
        $s1 = "http://83.138.53.110/service/save.php" ascii wide nocase  // URLs
        $s2 = "185.220.101.15" ascii wide nocase  // IPv4
        $s3 = "192.42.116.14" ascii wide nocase  // IPv4
        $s4 = "83.138.53.110" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "338662fd0c4d750a0ba203a32b59f081" or
        hash.md5(0, filesize) == "8c5b72906e8183037532afc3f4639931" or
        hash.sha1(0, filesize) == "17e771c78430cc67e71d4547f8996a1a488e9d3f" or
        hash.sha256(0, filesize) == "0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e" or
        hash.sha256(0, filesize) == "2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb2" or
        hash.sha256(0, filesize) == "2f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cff" or
        hash.sha256(0, filesize) == "d91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383a" or
        hash.sha256(0, filesize) == "fd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5"
}