import "hash"

rule bulwark_https_bulwarkblack_com_packclient_phishing_execution_controls
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/packclient-phishing-execution-controls/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-28T20:03:07Z"
        tlp = "TLP:CLEAR"
        indicator_count = "18"
    strings:
        $s0 = "gov12366.com" ascii wide nocase  // Domains
        $s1 = "http://154.36.188.98:8080/Sz9110.bin" ascii wide nocase  // URLs
        $s2 = "154.36.188.201" ascii wide nocase  // IPv4
        $s3 = "154.36.188.98" ascii wide nocase  // IPv4
        $s4 = "192.229.87.219" ascii wide nocase  // IPv4
        $s5 = "192.252.180.45" ascii wide nocase  // IPv4
        $s6 = "206.238.196.96" ascii wide nocase  // IPv4
        $s7 = "64.81.30.99" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b7" or
        hash.sha256(0, filesize) == "35712dc8aa497371ce48a36975781dfc3a120ce5c99dc209637b05751bf4e8e9" or
        hash.sha256(0, filesize) == "38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c" or
        hash.sha256(0, filesize) == "7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a" or
        hash.sha256(0, filesize) == "7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94" or
        hash.sha256(0, filesize) == "832e68e12ebf62b60cfe2a7b45e5948fcc364a74c8d73c3748b267617bcfb242" or
        hash.sha256(0, filesize) == "83d16cd963b1926a9967e6928340f099abf983ca496639cfddd9d63e327db3d2" or
        hash.sha256(0, filesize) == "aa8cda8a9a7835a72d1b832985c5976873d2c6e791524039b809ce4441d3f69f" or
        hash.sha256(0, filesize) == "da90b1219dcf1bf23e604b182b7737e188825df7205ea7b172231de66aeba293" or
        hash.sha256(0, filesize) == "fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53"
}