import "hash"

rule bulwark_https_bulwarkblack_com_jsceal_compiled_v8_bytecode_malware_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/jsceal-compiled-v8-bytecode-malware-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-01T18:54:29Z"
        tlp = "TLP:CLEAR"
        indicator_count = "110"
    strings:
        $s0 = "console.info" ascii wide nocase  // Domains
        $s1 = "cursor.click" ascii wide nocase  // Domains
        $s2 = "iapi.kraken.com" ascii wide nocase  // Domains
        $s3 = "resources.live.ledger.app" ascii wide nocase  // Domains
        $s4 = "13.6.233.10" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "03f4e47b9c2283c32bb8f8f042ce6e41" or
        hash.md5(0, filesize) == "09dbfac09f9cafdbc7d225eb144f0e69" or
        hash.md5(0, filesize) == "0b8015cbb1ffdc6efe6a306ff5b1115f" or
        hash.md5(0, filesize) == "0d1fce0cb2b9dec26a10f0822aeffb19" or
        hash.md5(0, filesize) == "1026743185dfa10e9ddc21b5a4c578d5" or
        hash.md5(0, filesize) == "10c576a57fc040eddd84d631786b8dda" or
        hash.md5(0, filesize) == "13823095b8d31013ba41a5c98ce69b59" or
        hash.md5(0, filesize) == "1b7f4288b12373c8d6488fde69c8ce0d" or
        hash.md5(0, filesize) == "201f28b5e62e52e269757930f941c774" or
        hash.md5(0, filesize) == "2477fd3e348c51bf575ede398253d0b3" or
        hash.md5(0, filesize) == "2841170a19c028c16990cdcc6fd499bc" or
        hash.md5(0, filesize) == "2fe27eb8c99626e8c02e4bfd02aca962" or
        hash.md5(0, filesize) == "30f23bb28ce56584f8f098ff0035b029" or
        hash.md5(0, filesize) == "376ec4dbc3363fa7131367e4c6327a46" or
        hash.md5(0, filesize) == "454fb012cdd0736e4ed41fabf0916f46" or
        hash.md5(0, filesize) == "462195f7f8033df7371e899fe9bc51de" or
        hash.md5(0, filesize) == "469c60508d4470bc1cc5e4a70d0e7112" or
        hash.md5(0, filesize) == "499184635d56a9827d2059256a35e530" or
        hash.md5(0, filesize) == "533d0b93ea03cd5bab4eec0f0ebadd03" or
        hash.md5(0, filesize) == "576e94d705bd50811dc9525a45732bc3" or
        hash.md5(0, filesize) == "581e2e2265d0c1509b3799c5a9039374" or
        hash.md5(0, filesize) == "6626b8caf2734c83a93f78d31b703584" or
        hash.md5(0, filesize) == "68ac84a8470d1f365f0bb2f37b6256d5" or
        hash.md5(0, filesize) == "6e023b9b3097a2dba311cb06a91fe259" or
        hash.md5(0, filesize) == "710cc97e64618c68ffca72ac405a48a1" or
        hash.md5(0, filesize) == "7650ec266b414d097101da12c4384659" or
        hash.md5(0, filesize) == "7b659fa5c93af29c4e11d8c8be437058" or
        hash.md5(0, filesize) == "8fb3e6acb2024601eba0ba484091ff3d" or
        hash.md5(0, filesize) == "91038aebe528a065c3e995a418db6826" or
        hash.md5(0, filesize) == "975319142460fc43e3dc5e495d2313c9" or
        hash.md5(0, filesize) == "a2aa25f0d5b23a2897576e4cf9596a7c" or
        hash.md5(0, filesize) == "a308fa1524c9d5b8dc55d2b296a2629b" or
        hash.md5(0, filesize) == "a6f5bb2b8a3e1abe332dd40e50d78aa3" or
        hash.md5(0, filesize) == "af105a6d4dc10b2bfefd75e917245523" or
        hash.md5(0, filesize) == "b2dad3f88b7f6870f83eb1ad852b7f7e" or
        hash.md5(0, filesize) == "c605371a8caf11497f1879597292e338" or
        hash.md5(0, filesize) == "c8db5e53572e68349c76107f03544491" or
        hash.md5(0, filesize) == "cd7afa032d5f5be0db037edb617f438b" or
        hash.md5(0, filesize) == "d064dfaaef30c057b832c79996c35e89" or
        hash.md5(0, filesize) == "d5b4137135cf121e3ea07b1c81fe1108" or
        hash.md5(0, filesize) == "de10c6b3dc4619f59bc9c80a0aa15e6a" or
        hash.md5(0, filesize) == "e26687982d924ffebef6fbf2d9d43350" or
        hash.md5(0, filesize) == "e27ae65977287bdfb7b0e15fd3603f85" or
        hash.md5(0, filesize) == "e57f6ca6543616f75f7811273616fe47" or
        hash.md5(0, filesize) == "e711a90b5ece5380e1acaed56827e8d5" or
        hash.md5(0, filesize) == "e81b35b76b4d97751c0724bc0c7f3b83" or
        hash.md5(0, filesize) == "e8b5448b4f7b013e8c6191b20d3f8291" or
        hash.md5(0, filesize) == "fa0180946b9a6ad373b7a8f983e2e597" or
        hash.md5(0, filesize) == "fd4494c555adda2eb54b88f5c9c08801" or
        hash.sha256(0, filesize) == "058ae4136e241f116d8c5b1a1cad15b53090797154539faa35706568fbd85d9b" or
        hash.sha256(0, filesize) == "05db78bff1a48a674e70368b96a550a5f9f93271eb261ab63b36ee37e0e8b9f8" or
        hash.sha256(0, filesize) == "06dce0f294c62f2a2393c812ff711bde831bf420a4df484bcf5b6241fc0f00d0" or
        hash.sha256(0, filesize) == "09f803f69bde280adbd4e584ed26a01affac9721db8c5730275d385f084b422a" or
        hash.sha256(0, filesize) == "0c31453e74a3b763c7aea550b4f5f194e7656226012b243221eb93fa22da118e" or
        hash.sha256(0, filesize) == "0c72513efdae9785894b6e925590d0b59b652dda53b8cd882037a87e672a4a5a" or
        hash.sha256(0, filesize) == "11e85a8306057945accc65395b780377c07d4ec9ae52d78185554bf1957e3caa" or
        hash.sha256(0, filesize) == "18347a39f174c97947649b3f1de55e8409ff805e808f2101e5953a956e9ee99f" or
        hash.sha256(0, filesize) == "192342a5e4fcfc5e8ec430427e1dfa773fd324e3d7215047f36f1114ef930f4e" or
        hash.sha256(0, filesize) == "1b0efeb1d988b7bc11014ccc9fdff141fc16425d659f553f6cc6946872499667" or
        hash.sha256(0, filesize) == "1f5acba97db6d514e4b35ba0601c5269697e8ab3bb99d097db25ec7e74464594" or
        hash.sha256(0, filesize) == "22833568125bcc55000503cfe6b470925b7d095ff7592bef79fe52e0573123cc" or
        hash.sha256(0, filesize) == "2c29b4089845b010428f8be48e62f165e0f7f8a48e58200629c6020c7ac2cab7" or
        hash.sha256(0, filesize) == "2cf2d22d1317df6c49171be61ef35c4f6c3da17785fa73e68aa95109075f79bd" or
        hash.sha256(0, filesize) == "2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf4545841462" or
        hash.sha256(0, filesize) == "31b38e76ccaca6f38168b4fdd9cbdedd8efa7e65fe6090240e281bd3152a6feb" or
        hash.sha256(0, filesize) == "36d34b6405a33fcb95e1323e2ca8c688af02b315fc1bded19fa27bd1c7ca6f1c" or
        hash.sha256(0, filesize) == "395f4c1562a1a8caeba254ccbc7d278b8194795ff5ad3824cfc0c566273835f0" or
        hash.sha256(0, filesize) == "3d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e9" or
        hash.sha256(0, filesize) == "43c57c60a8008e617b16dc6dab29372347ebe144f043200c106149c3106438ba" or
        hash.sha256(0, filesize) == "484da78b0fef35711f86876f7c1c77264b8e4295d7393369379c384c05337ec5" or
        hash.sha256(0, filesize) == "504345099ba4c77cbb4224101794e525f2bc9adb40904159195c17d7e345085e" or
        hash.sha256(0, filesize) == "57f32b3942d5543177f07e49fc84f1409a49b5df7d25549e543607c223b87695" or
        hash.sha256(0, filesize) == "59c9038227c634f4e512afaa98f2ca998b0aaac83437c218686c51acbda7873e" or
        hash.sha256(0, filesize) == "5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0" or
        hash.sha256(0, filesize) == "5b4edd9bffdd7909b8b432eacd463d59eb23eba151c9e218161ab15dd72d55ed" or
        hash.sha256(0, filesize) == "5f071a36c0a79ddce92824a49fd8e9bd048b87cabb635671073402365afc342a" or
        hash.sha256(0, filesize) == "5fe810cb5b34c8fd07c7eca301b32ef2d3b86290828d67edaad8444db811f20b" or
        hash.sha256(0, filesize) == "6075cd41edb59c43c13aa3591e054cdb127b17bf34e036dae591244ea2f8868f" or
        hash.sha256(0, filesize) == "684aabefe516539cda48c65cb08014e6eb645b4f1e668d159fe0c18cf74eb407" or
        hash.sha256(0, filesize) == "6b498ec73d32860202b6a6ff8d21f8b5216c3903e066136f9d69ef2969955a78" or
        hash.sha256(0, filesize) == "742ad2dd3d2444bd3758b6e46dd76f9c43dfaae03bdffc3598ce7d8ab3cd3ac5" or
        hash.sha256(0, filesize) == "7e1c82cdcff73ac69fee3ba71d67353a062103f1bfae4f263d03b3b84e48d782" or
        hash.sha256(0, filesize) == "7f3e73b2e0ebea3eaffa3685e0a162d10fde388282060d9e35b173b743676916" or
        hash.sha256(0, filesize) == "82f8215c7e68f4a6b656b7dc6638982a6625c662ce6d6a05330eefbfde2637ac" or
        hash.sha256(0, filesize) == "84db0663b6aa8df2ac04470288fd5528f5537fb89d78a2e01cabdce371a686e8" or
        hash.sha256(0, filesize) == "88b1d75d330cf6be9a7f48cdfd51c48125a86f9bcb6bcb736fb8399e0617d680" or
        hash.sha256(0, filesize) == "8abffe0d13d3b93ca3469045e4cebbee25b3631e6bba13880f04b7c8acac2536" or
        hash.sha256(0, filesize) == "8b3ed808822479eb62d78d819db35362e4e79138ac82310d30e0c351a17992b6" or
        hash.sha256(0, filesize) == "8c674f58b157a7319b564bb774e7aeb35135d615511838e4a553fe7ea9e94759" or
        hash.sha256(0, filesize) == "94191824bb5062622663e2434d2b749a8c936eb573aaac23594dee8dda304731" or
        hash.sha256(0, filesize) == "95b39a0bad021f33e08df042b02d3267faee7bbc3e3080dda295c35b464dd607" or
        hash.sha256(0, filesize) == "9615f60ea3cc1c65eb8fe6d77bb85fe6b455503193eab02310a873fccadd332e" or
        hash.sha256(0, filesize) == "9b5359dc99501ef2a4667d265e9b032f76dc28c97437a463965e2168d20e5c38" or
        hash.sha256(0, filesize) == "9f673e3b361f438e9986f2a7b2423d3d02dbecea0c220163566850ef6ab56626" or
        hash.sha256(0, filesize) == "acdaba94e9975e8e03fa13bae7f0f93f165f42226aeecea3af5a4e0111bdfb7e" or
        hash.sha256(0, filesize) == "aec3e252c429e150c42976d6badeea31e48a0356ecbd27796df83fc6d3de16ea" or
        hash.sha256(0, filesize) == "b73c3d732bb6bff8b9088cc0dcbadb35eea0802056324f1b6295cb9277c62755" or
        hash.sha256(0, filesize) == "c12ac711b4ceaa17a4e48b16fca7dabd615e4eaf35bb65fe9131ceac1687095a" or
        hash.sha256(0, filesize) == "c13fcb214a576401cd624dacf248480c38b8bcbb85e5d3da52cc204a61395d14" or
        hash.sha256(0, filesize) == "c288e79ed9d1fb654a341b92d878a3165a09fb21dfa826f3559b46738fdbbdeb" or
        hash.sha256(0, filesize) == "caf8bfc90e4300b8a18c3fe3a4badbe44c106830e7432d8eea227857a790ec91" or
        hash.sha256(0, filesize) == "cfdb3bb9edea8de7c7a70275a2b8689619276f1e5f2b8805e67ceab1ee252f6d" or
        hash.sha256(0, filesize) == "dd2bb7316be55446aebfa31d05e57e936eb9a18d5d9c20d60d87493100d05fe6" or
        hash.sha256(0, filesize) == "f6c670e65765d10a5ca0205a6ece3a3e6c7c730b0a8534c5adef4a3cbf06eb9c" or
        hash.sha256(0, filesize) == "fa02e707af9a353f0e2d7a77489c11c2249a1d9dbccf74070130b31834e8d7c3"
}