import "hash"

rule bulwark_https_bulwarkblack_com_macsync_macos_stealer_backdoor_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/macsync-macos-stealer-backdoor-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-28T01:07:10Z"
        tlp = "TLP:CLEAR"
        indicator_count = "54"
    strings:
        $s0 = "apple03cloudstore.com" ascii wide nocase  // Domains
        $s1 = "caldav.icloud.com" ascii wide nocase  // Domains
        $s2 = "com.mx" ascii wide nocase  // Domains
        $s3 = "docsend.appstore.com.mx" ascii wide nocase  // Domains
        $s4 = "gateway.icloud.com" ascii wide nocase  // Domains
        $s5 = "slack.apple03cloudstore.com" ascii wide nocase  // Domains
        $s6 = "streamyard.appstore.com.mx" ascii wide nocase  // Domains
        $s7 = "toria.app" ascii wide nocase  // Domains
        $s8 = "toria.apple03cloudstore.com" ascii wide nocase  // Domains
        $s9 = "waaako.appstore.com.mx" ascii wide nocase  // Domains
        $s10 = "warpcast.asia" ascii wide nocase  // Domains
        $s11 = "http://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08" ascii wide nocase  // URLs
        $s12 = "https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08" ascii wide nocase  // URLs
        $s13 = "https://docsend.appstore.com.mx" ascii wide nocase  // URLs
        $s14 = "https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc" ascii wide nocase  // URLs
        $s15 = "https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc" ascii wide nocase  // URLs
        $s16 = "https://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc" ascii wide nocase  // URLs
        $s17 = "https://slack.apple03cloudstore.com/installer.sh" ascii wide nocase  // URLs
        $s18 = "https://streamyard.appstore.com.mx/installer.sh" ascii wide nocase  // URLs
        $s19 = "https://toria.app/" ascii wide nocase  // URLs
        $s20 = "https://toria.apple03cloudstore.com" ascii wide nocase  // URLs
        $s21 = "https://toria.apple03cloudstore.com/" ascii wide nocase  // URLs
        $s22 = "https://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc" ascii wide nocase  // URLs
        $s23 = "https://waaako.appstore.com.mx/installer.sh" ascii wide nocase  // URLs
        $s24 = "https://warpcast.asia/Toria.dmg" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "00d12d842596bf5ee1805effb4571d30" or
        hash.md5(0, filesize) == "09425f72de8bba18893dcd6f04115891" or
        hash.md5(0, filesize) == "26a0f7cdb9f7dc5ace9a40af825b1538" or
        hash.md5(0, filesize) == "2d69812584269699fade26622e6490c5" or
        hash.md5(0, filesize) == "3a1af2b397c6958e6c3ba3c75912d60e" or
        hash.md5(0, filesize) == "3ded1d71a822b53b12c3b67bcaf633f5" or
        hash.md5(0, filesize) == "3deeed48fd38f22e369f5c3092bd68a1" or
        hash.md5(0, filesize) == "4203ec932bfcc0907f91732440d6d997" or
        hash.md5(0, filesize) == "6791dad263cac6d63ebba6a4b57e7d71" or
        hash.md5(0, filesize) == "7212229c85852c3bffaf9740002b2f39" or
        hash.md5(0, filesize) == "781ce50001d4b449600afa347c9b0208" or
        hash.md5(0, filesize) == "7df1049cbd56c0bfa4a3364a379b4c2c" or
        hash.md5(0, filesize) == "8d371f8a7a6dcc2655544ae13cbca03d" or
        hash.md5(0, filesize) == "8dc8561349d144d4661bc66f2ec49f9f" or
        hash.md5(0, filesize) == "8e84b01d5ac9624f0b181ade0e737193" or
        hash.md5(0, filesize) == "980e2134679bc0c609f7659882883d77" or
        hash.md5(0, filesize) == "9a0043d900a9ac78c886c59c9a328fd0" or
        hash.md5(0, filesize) == "9f15fe9c4415cd668334339f705b94d8" or
        hash.md5(0, filesize) == "c53d0ea45dbc622afb7f16ea3eec78bc" or
        hash.md5(0, filesize) == "eb760d5c88f13f7ee0f8f86ba3407123" or
        hash.md5(0, filesize) == "f97d24212fa6a21be0c4d211e10f044c" or
        hash.md5(0, filesize) == "f9f70096aabb4d22a6657014f4853a53" or
        hash.md5(0, filesize) == "fb90887592655a8c989e443c640167aa" or
        hash.md5(0, filesize) == "fc3ba5ed282d77127efd0b0f2403531b" or
        hash.sha256(0, filesize) == "3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a" or
        hash.sha256(0, filesize) == "b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650" or
        hash.sha256(0, filesize) == "cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca" or
        hash.sha256(0, filesize) == "ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d" or
        hash.sha256(0, filesize) == "ff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c"
}