import "hash"

rule bulwark_https_bulwarkblack_com_hospitality_photo_zip_nodejs_implant_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/hospitality-photo-zip-nodejs-implant-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "92"
    strings:
        $s0 = "aluminiostramuntana.com" ascii wide nocase  // Domains
        $s1 = "bookreservphoto.pro" ascii wide nocase  // Domains
        $s2 = "dancamp.info" ascii wide nocase  // Domains
        $s3 = "dashgamein.info" ascii wide nocase  // Domains
        $s4 = "deeprace.info" ascii wide nocase  // Domains
        $s5 = "derbyoni.info" ascii wide nocase  // Domains
        $s6 = "doc-imagehub.info" ascii wide nocase  // Domains
        $s7 = "docshub-01.info" ascii wide nocase  // Domains
        $s8 = "docshub-secure.com" ascii wide nocase  // Domains
        $s9 = "docstore-safe.info" ascii wide nocase  // Domains
        $s10 = "expedla-getphoto.cloud" ascii wide nocase  // Domains
        $s11 = "fairyspells.info" ascii wide nocase  // Domains
        $s12 = "finallyrain.info" ascii wide nocase  // Domains
        $s13 = "hakeiwjs727wj.com" ascii wide nocase  // Domains
        $s14 = "haobbao.com" ascii wide nocase  // Domains
        $s15 = "heliosup.info" ascii wide nocase  // Domains
        $s16 = "higoksbupwou.com" ascii wide nocase  // Domains
        $s17 = "image-vlt.info" ascii wide nocase  // Domains
        $s18 = "imagestore-hub.info" ascii wide nocase  // Domains
        $s19 = "imagevault-safe.info" ascii wide nocase  // Domains
        $s20 = "ip-api.com" ascii wide nocase  // Domains
        $s21 = "joincroud.info" ascii wide nocase  // Domains
        $s22 = "kellystreets.info" ascii wide nocase  // Domains
        $s23 = "kelopins.info" ascii wide nocase  // Domains
        $s24 = "kentjerk.info" ascii wide nocase  // Domains
        $s25 = "keypmenu.info" ascii wide nocase  // Domains
        $s26 = "kinghoruswe.info" ascii wide nocase  // Domains
        $s27 = "kiptownim.info" ascii wide nocase  // Domains
        $s28 = "lestresot.info" ascii wide nocase  // Domains
        $s29 = "lookinlip.info" ascii wide nocase  // Domains
        $s30 = "ministrew.info" ascii wide nocase  // Domains
        $s31 = "montagelips.info" ascii wide nocase  // Domains
        $s32 = "photo-21473.xyz" ascii wide nocase  // Domains
        $s33 = "photo-box.info" ascii wide nocase  // Domains
        $s34 = "photo-dekor.xyz" ascii wide nocase  // Domains
        $s35 = "photo-hub-io.info" ascii wide nocase  // Domains
        $s36 = "photobook-reserv.pro" ascii wide nocase  // Domains
        $s37 = "photobookadm.pro" ascii wide nocase  // Domains
        $s38 = "photodoc-secure.info" ascii wide nocase  // Domains
        $s39 = "photosafe-hub.info" ascii wide nocase  // Domains
        $s40 = "prejointl.info" ascii wide nocase  // Domains
        $s41 = "racestrech.info" ascii wide nocase  // Domains
        $s42 = "recallnine.info" ascii wide nocase  // Domains
        $s43 = "recepyman.info" ascii wide nocase  // Domains
        $s44 = "recstrace.info" ascii wide nocase  // Domains
        $s45 = "reservebookphot.pro" ascii wide nocase  // Domains
        $s46 = "safe-picvault.info" ascii wide nocase  // Domains
        $s47 = "safedoc-storage.info" ascii wide nocase  // Domains
        $s48 = "safedoc-vault.info" ascii wide nocase  // Domains
        $s49 = "safedocphoto.info" ascii wide nocase  // Domains
        $s50 = "safephoto-vault.info" ascii wide nocase  // Domains
        $s51 = "safevault-hub.info" ascii wide nocase  // Domains
        $s52 = "sec-safe-dc.info" ascii wide nocase  // Domains
        $s53 = "secure-imagehub.info" ascii wide nocase  // Domains
        $s54 = "snapkeep.info" ascii wide nocase  // Domains
        $s55 = "tripadvisor-photo-view.com" ascii wide nocase  // Domains
        $s56 = "vertualstreak.info" ascii wide nocase  // Domains
        $s57 = "visa-safedocs.info" ascii wide nocase  // Domains
        $s58 = "visa-vault.info" ascii wide nocase  // Domains
        $s59 = "visaimage-storage.icu" ascii wide nocase  // Domains
        $s60 = "visaimages.info" ascii wide nocase  // Domains
        $s61 = "visaphoto-secure.info" ascii wide nocase  // Domains
        $s62 = "visaphoto-vault.info" ascii wide nocase  // Domains
        $s63 = "widjssij728dj.com" ascii wide nocase  // Domains
        $s64 = "172.67.161.215" ascii wide nocase  // IPv4
        $s65 = "178.16.54.27" ascii wide nocase  // IPv4
        $s66 = "178.16.55.179" ascii wide nocase  // IPv4
        $s67 = "193.202.84.32" ascii wide nocase  // IPv4
        $s68 = "208.95.112.1" ascii wide nocase  // IPv4
        $s69 = "95.217.97.121" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "17082531775760189576112827972435" or
        hash.md5(0, filesize) == "25908558764390958596189327204542" or
        hash.sha256(0, filesize) == "04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1" or
        hash.sha256(0, filesize) == "06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969" or
        hash.sha256(0, filesize) == "1c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a" or
        hash.sha256(0, filesize) == "1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd" or
        hash.sha256(0, filesize) == "2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc" or
        hash.sha256(0, filesize) == "3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b44" or
        hash.sha256(0, filesize) == "49cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd" or
        hash.sha256(0, filesize) == "63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae" or
        hash.sha256(0, filesize) == "6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca9" or
        hash.sha256(0, filesize) == "83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7" or
        hash.sha256(0, filesize) == "89934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c1028" or
        hash.sha256(0, filesize) == "97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f" or
        hash.sha256(0, filesize) == "98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c8" or
        hash.sha256(0, filesize) == "9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2" or
        hash.sha256(0, filesize) == "b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea" or
        hash.sha256(0, filesize) == "bd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9" or
        hash.sha256(0, filesize) == "c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5" or
        hash.sha256(0, filesize) == "d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11" or
        hash.sha256(0, filesize) == "da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291c" or
        hash.sha256(0, filesize) == "f629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14"
}