import "hash"

rule bulwark_https_bulwarkblack_com_midnight_mimosa_android_firmware_supply_chain_controls
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/midnight-mimosa-android-firmware-supply-chain-controls/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-08T20:05:30Z"
        tlp = "TLP:CLEAR"
        indicator_count = "155"
    strings:
        $s0 = "0aa0cf0637d66c0d.com" ascii wide nocase  // Domains
        $s1 = "442fe7151fb1e9b5.com" ascii wide nocase  // Domains
        $s2 = "5.ahd187.com" ascii wide nocase  // Domains
        $s3 = "aa86a52a98162b7d.com" ascii wide nocase  // Domains
        $s4 = "ahd187.com" ascii wide nocase  // Domains
        $s5 = "api.weatherlive.world" ascii wide nocase  // Domains
        $s6 = "cgb.jingongbuxiao.com" ascii wide nocase  // Domains
        $s7 = "com.ads.cal" ascii wide nocase  // Domains
        $s8 = "com.android.gallery" ascii wide nocase  // Domains
        $s9 = "com.audify.editor.pro" ascii wide nocase  // Domains
        $s10 = "com.dmstudio.weather" ascii wide nocase  // Domains
        $s11 = "com.fb.w.weather" ascii wide nocase  // Domains
        $s12 = "com.mobile.applock.tg" ascii wide nocase  // Domains
        $s13 = "com.yun.wth.er" ascii wide nocase  // Domains
        $s14 = "fyapi.freeflightbird.com" ascii wide nocase  // Domains
        $s15 = "kwlib.next" ascii wide nocase  // Domains
        $s16 = "newsadapi.zhuifengzhe.top" ascii wide nocase  // Domains
        $s17 = "oeawmfedpcleaih9.apple.0aa0cf0637d66c0d.com" ascii wide nocase  // Domains
        $s18 = "oeawmfedpcleaih9.apple.442fe7151fb1e9b5.com" ascii wide nocase  // Domains
        $s19 = "org.life.goal.tools" ascii wide nocase  // Domains
        $s20 = "oss.showtimetool.com" ascii wide nocase  // Domains
        $s21 = "showtimetool.com" ascii wide nocase  // Domains
        $s22 = "v46wd6uramzkmeeo.in" ascii wide nocase  // Domains
        $s23 = "w.post" ascii wide nocase  // Domains
        $s24 = "weatherlive.world" ascii wide nocase  // Domains
        $s25 = "zhuifengzhe.top" ascii wide nocase  // Domains
        $s26 = "https://api.weatherlive.world/br_upgrade/upgradeV2/getConfigs" ascii wide nocase  // URLs
        $s27 = "https://oss.showtimetool.com/...png" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "0377ca97ac0ca35f9134052fede67a81" or
        hash.md5(0, filesize) == "05ae89e761a890fa24f80f4be7263651" or
        hash.md5(0, filesize) == "079298a7a506b376def4f4ff9a250672" or
        hash.md5(0, filesize) == "08d231c6a5303e543eb60d4181f6a4ea" or
        hash.md5(0, filesize) == "0903d7fd3e1d4a599a7eb3c5d356779b" or
        hash.md5(0, filesize) == "0a26a9d5f7ab91cb5eed852cf83ef078" or
        hash.md5(0, filesize) == "0b0d8e995e6ff24d4e9d00417446c25e" or
        hash.md5(0, filesize) == "0b8d3cd264c191f4884a25d0cc5318b5" or
        hash.md5(0, filesize) == "1150da1af88729e54a34b8da5a2741c7" or
        hash.md5(0, filesize) == "1414d4ef2d1191080abc59a407dcb6c5" or
        hash.md5(0, filesize) == "145b806282d247441751bb4957b71606" or
        hash.md5(0, filesize) == "1da42505f1c83959c7f901f5139a158e" or
        hash.md5(0, filesize) == "20108557cacd24263e7e611afc327801" or
        hash.md5(0, filesize) == "20cefb2c667f945d482daded7e698eea" or
        hash.md5(0, filesize) == "250205ee4b8de59e60c745856f439608" or
        hash.md5(0, filesize) == "254bc5f6f81de1f3c47534e6febaf023" or
        hash.md5(0, filesize) == "294ab3f586d76772ae89add417cf6324" or
        hash.md5(0, filesize) == "2b784622422f4280e0b3e38b30dd87bc" or
        hash.md5(0, filesize) == "2b7f1a7d5f5515c05d0c8e3857155ae2" or
        hash.md5(0, filesize) == "2c77653b889dfccd649b82446f8c0d1b" or
        hash.md5(0, filesize) == "2de346602433cdd1668f36b2e9db0be1" or
        hash.md5(0, filesize) == "31b3280f1c0836c39c470932cf6c3e6f" or
        hash.md5(0, filesize) == "33b2d3ec9a35cfb0b5a5d7b24ce4140e" or
        hash.md5(0, filesize) == "345057421c7d9ac2b671c47449f35030" or
        hash.md5(0, filesize) == "36deebfcda4012d18706cd170c1edf1f" or
        hash.md5(0, filesize) == "36f9e8cf47a28f9803fba427cf02a25c" or
        hash.md5(0, filesize) == "37f18a20b9cf32e6f07450e903eaad7c" or
        hash.md5(0, filesize) == "387f7af167530486adcf3d8546063462" or
        hash.md5(0, filesize) == "3b20edff1125e146aa3d5153708b58f4" or
        hash.md5(0, filesize) == "3b35d3c5667136134b20a8411803c97d" or
        hash.md5(0, filesize) == "3bb270d4927e2a8385793d9084a92fd3" or
        hash.md5(0, filesize) == "3bc159537c909fa86bcc55eda127b5aa" or
        hash.md5(0, filesize) == "3c098465af131141996ff840bd34e791" or
        hash.md5(0, filesize) == "3d3358b1057b1bfbd7e60577d8a31e0c" or
        hash.md5(0, filesize) == "42a9f64e75911c167ec7a163e8b24920" or
        hash.md5(0, filesize) == "4507363415e7dc6d2cab14eeed137f6c" or
        hash.md5(0, filesize) == "4521a5bbe0f33a15da86bd80ff5d6d9c" or
        hash.md5(0, filesize) == "4a171f62d1bab01827b06ae73d4caafa" or
        hash.md5(0, filesize) == "4e46549122c0236307c5eef8891466f5" or
        hash.md5(0, filesize) == "4f7d3c5859100d65ff02449884841b9c" or
        hash.md5(0, filesize) == "50e9cdc3ed145bbc688356eda07f8eb3" or
        hash.md5(0, filesize) == "512a6db4a22244272826f39da020fb44" or
        hash.md5(0, filesize) == "5400ffac371c5e5c9b7f3705ce9faca5" or
        hash.md5(0, filesize) == "542ab80429ec42e8643dc645f58b716c" or
        hash.md5(0, filesize) == "5b3a49938f455d1197736971c4c07228" or
        hash.md5(0, filesize) == "5d29e9b24708c3ec36d1d59036124838" or
        hash.md5(0, filesize) == "60bc23d3d453f258e2c4ca421cd086a9" or
        hash.md5(0, filesize) == "61aac6a98abd6dcff0dc41bb88159786" or
        hash.md5(0, filesize) == "642d84ed5660407b972f1df642acb192" or
        hash.md5(0, filesize) == "66c6512b9a73425aba40c8bfa95d23a0" or
        hash.md5(0, filesize) == "6739fe083cfa8dec9b4f989ccba0e99e" or
        hash.md5(0, filesize) == "6aca76699ec0bb8e51372d5c68c8359b" or
        hash.md5(0, filesize) == "6df909898f5f1394e78508d1152fab38" or
        hash.md5(0, filesize) == "6ee2be3e5558085b532dacc8db61f3e9" or
        hash.md5(0, filesize) == "6eea0568d5cc776ae03e09149cec3cd8" or
        hash.md5(0, filesize) == "7322d8a65a56a7ab09f4d526cb343e3d" or
        hash.md5(0, filesize) == "7400c34f7c6f866499029f5e759f58bd" or
        hash.md5(0, filesize) == "7469c9c06e5f324ca608e0140156bbad" or
        hash.md5(0, filesize) == "765d3ce85a6393d05973c4cfa7738116" or
        hash.md5(0, filesize) == "7f7747575980098bdc98e7b7aa362697" or
        hash.md5(0, filesize) == "815b910f1efc95f38ba0c5b12c4f2129" or
        hash.md5(0, filesize) == "836739fe7196437d8e998245b6f2b3b4" or
        hash.md5(0, filesize) == "838dc8fcde1b28171e404ece1cfcde44" or
        hash.md5(0, filesize) == "879168159c155758dbfd7a76e8f21548" or
        hash.md5(0, filesize) == "8ec360829f4f7ae8dcae47c02b996762" or
        hash.md5(0, filesize) == "90e0d27d808105167fdaa3a22b918217" or
        hash.md5(0, filesize) == "92390cacdd20d2ee5405093669e7302c" or
        hash.md5(0, filesize) == "92f2fd8bcccc8ec4ffa64c7f6b3b9b8d" or
        hash.md5(0, filesize) == "998e9010e5dfc4e4645f5572cbbe5b53" or
        hash.md5(0, filesize) == "9a3d04aa36654b5c4b21edd22e46f92d" or
        hash.md5(0, filesize) == "9a46098de785ae732e5fced55a2f3063" or
        hash.md5(0, filesize) == "9e7b34e63d8d38e37667f88a945ae69a" or
        hash.md5(0, filesize) == "9f1e2249003ab22cf8a38048e0ff6f6c" or
        hash.md5(0, filesize) == "a02f28387527abe90d73d2879f671972" or
        hash.md5(0, filesize) == "a13af0174bc211709e8b73bf60492a17" or
        hash.md5(0, filesize) == "a147cd8f72aadfcf78f7723db6813e86" or
        hash.md5(0, filesize) == "a57a1ba15364dfb35d334f644d7049e8" or
        hash.md5(0, filesize) == "a8847b68428fde206b6dff8001051f92" or
        hash.md5(0, filesize) == "aac942aaf6ec0773cbac87fde4a6b284" or
        hash.md5(0, filesize) == "ab8d6be686ca9413e27a11e85f9cef1a" or
        hash.md5(0, filesize) == "abe12db77a62ecb99d6ab5dc4fff18c7" or
        hash.md5(0, filesize) == "ac8957a474f8aa812c7b233aafde4723" or
        hash.md5(0, filesize) == "af16072864ae0f9d755f8cf00fded359" or
        hash.md5(0, filesize) == "af7f1eef22bf5ee3d0a394f53ba7e1b8" or
        hash.md5(0, filesize) == "b3a4405d1b8d43545d07b10581008d32" or
        hash.md5(0, filesize) == "b6c5f7dfaf9d47cd67380a48df5e1731" or
        hash.md5(0, filesize) == "b7d0d5ae09b0d2d2f999c1087c450456" or
        hash.md5(0, filesize) == "b862681953e945439167a736ba4cd41b" or
        hash.md5(0, filesize) == "b974ef4106af6b932df352563a9b8b3c" or
        hash.md5(0, filesize) == "be22c91b4578ac2357a16133615df335" or
        hash.md5(0, filesize) == "c55c9d7e12cc273b812ceffca8f62d4b" or
        hash.md5(0, filesize) == "c75ec7f3bcbc879aae9a21ad544d3232" or
        hash.md5(0, filesize) == "c8ea2a7c1f52c4c2474475c28373ee27" or
        hash.md5(0, filesize) == "ca7e2d265fc35aede432c4636a2cf4cb" or
        hash.md5(0, filesize) == "cb19dbf279a3488aec76c17e8e122c14" or
        hash.md5(0, filesize) == "cde0490e11db8ad54737c1df59ec658b" or
        hash.md5(0, filesize) == "cdfcc848e16660d607aba6ecf24567f4" or
        hash.md5(0, filesize) == "cf20de9d9ddc952bb2265002d26a916f" or
        hash.md5(0, filesize) == "cf4f24fdd283f80313565b08fea9d06d" or
        hash.md5(0, filesize) == "d145b14b9cc15799485f2592b2c16d9a" or
        hash.md5(0, filesize) == "d3faec4f013c4a1e84a1d681448312c0" or
        hash.md5(0, filesize) == "d4ceb05682ecd60f4ebb4e76e02fcf7d" or
        hash.md5(0, filesize) == "d56158a2cc8d13778df850907733b2c4" or
        hash.md5(0, filesize) == "d5d88214170875386ab855172f881e51" or
        hash.md5(0, filesize) == "d6ba4044f9d57f7e86d83187982ed593" or
        hash.md5(0, filesize) == "d9fc6b2cd5eaa3929207f1029663d947" or
        hash.md5(0, filesize) == "da67e37be01c20566990152ecfb14ed1" or
        hash.md5(0, filesize) == "dce5b0dc0e7d7059b5ab8384a7c24ec4" or
        hash.md5(0, filesize) == "de66cac88f156c3227749e03bdf7cf54" or
        hash.md5(0, filesize) == "e250e5966c119a9098f7818fc6c080e5" or
        hash.md5(0, filesize) == "e39bddf592016ad6d0784770df3e2ffe" or
        hash.md5(0, filesize) == "e51c11442a529dcd06dc7c8e45974ec2" or
        hash.md5(0, filesize) == "e6650dc6721aaa27f8a289ff92e613ff" or
        hash.md5(0, filesize) == "e75e183027bf897eda6447366c7acd01" or
        hash.md5(0, filesize) == "e7c56b4f580da53cd0e4f11d1a11e402" or
        hash.md5(0, filesize) == "e974cf4cc5d55cddc04f026dd3ea72b8" or
        hash.md5(0, filesize) == "e9b91e1d94bb3ff9a1c00b1c13eb7960" or
        hash.md5(0, filesize) == "e9ec6d7b50c1e54cd523283b9de55e10" or
        hash.md5(0, filesize) == "ed1a6bed83899952b464c27aef9752cc" or
        hash.md5(0, filesize) == "ee4e778e53ce4d4339d7c7888d06384d" or
        hash.md5(0, filesize) == "ee70ec99121f4d7c8b5a883e5ab3a858" or
        hash.md5(0, filesize) == "f0b7b1c940ebcee97eb68f528682fc50" or
        hash.md5(0, filesize) == "f456f0c6b89bd3d5124699d43971d094" or
        hash.md5(0, filesize) == "f602230f54507cbddf5ef3014737d768" or
        hash.md5(0, filesize) == "fac6548a4a7a88156468b809c4f877f5" or
        hash.md5(0, filesize) == "fc812444baa071f5141ddad812d673de" or
        hash.md5(0, filesize) == "fcb9f38cc687fc8a4637e0acdf91ab66"
}