import "hash"

rule bulwark_https_bulwarkblack_com_gremlin_stealer_browser_session_resource_obfuscation
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/gremlin-stealer-browser-session-resource-obfuscation/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:24:20Z"
        tlp = "TLP:CLEAR"
        indicator_count = "13"
    strings:
        $s0 = "ipify.org" ascii wide nocase  // Domains
        $s1 = "194.87.92.109" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5" or
        hash.sha256(0, filesize) == "2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b" or
        hash.sha256(0, filesize) == "281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2" or
        hash.sha256(0, filesize) == "691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3" or
        hash.sha256(0, filesize) == "971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759" or
        hash.sha256(0, filesize) == "9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614" or
        hash.sha256(0, filesize) == "9fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20" or
        hash.sha256(0, filesize) == "a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abd" or
        hash.sha256(0, filesize) == "ab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cd" or
        hash.sha256(0, filesize) == "d11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02c" or
        hash.sha256(0, filesize) == "f76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346"
}