import "hash"

rule bulwark_https_bulwarkblack_com_honeymyte_coolclient_rootkit_kernel_visibility_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/honeymyte-coolclient-rootkit-kernel-visibility-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:24:27Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "black-popular.com" ascii wide nocase  // Domains
        $s1 = "casacam.net" ascii wide nocase  // Domains
        $s2 = "cloudtroe.giize.com" ascii wide nocase  // Domains
        $s3 = "dursamjbataar.org" ascii wide nocase  // Domains
        $s4 = "employers.theworkpc.com" ascii wide nocase  // Domains
        $s5 = "freeread.casacam.net" ascii wide nocase  // Domains
        $s6 = "giize.com" ascii wide nocase  // Domains
        $s7 = "lenovoappstore.com" ascii wide nocase  // Domains
        $s8 = "news.dursamjbataar.org" ascii wide nocase  // Domains
        $s9 = "sundanish.freeddns.org" ascii wide nocase  // Domains
        $s10 = "theworkpc.com" ascii wide nocase  // Domains
        $s11 = "torinarlabs.webredirect.org" ascii wide nocase  // Domains
        $s12 = "us.lenovoappstore.com" ascii wide nocase  // Domains
        $s13 = "video.dursamjbataar.org" ascii wide nocase  // Domains
        $s14 = "whatismybestthing.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "2d7c8780e97409770a9d4f31c66c9d63" or
        hash.md5(0, filesize) == "9460e150e1981d5c165043520c5c12fe" or
        hash.md5(0, filesize) == "9717f005c5fb98e08d2ad983d88f94ee" or
        hash.md5(0, filesize) == "eb79558b037669792652a816e2c669de" or
        hash.md5(0, filesize) == "f518d8e5fe70d9090f6280c68a95998f"
}