import "hash"

rule bulwark_https_bulwarkblack_com_kazuar_p2p_botnet_russian_espionage_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/kazuar-p2p-botnet-russian-espionage-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "5"
    condition:
        hash.md5(0, filesize) == "82760b84f1d703d596c79b88ba4fac1e" or
        hash.sha256(0, filesize) == "436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c85" or
        hash.sha256(0, filesize) == "69908f05b436bd97baae56296bf9b9e734486516f9bb9938c2b8752e152315d4" or
        hash.sha256(0, filesize) == "6eb31006ca318a21eb619d008226f08e287f753aec9042269203290462eaa00d" or
        hash.sha256(0, filesize) == "c1f278f88275e07cc03bd390fe1cbeedd55933110c6fd16de4187f4c4aaf42b9"
}