import "hash"

rule bulwark_https_bulwarkblack_com_papercut_rce_print_server_compromise_review
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/papercut-rce-print-server-compromise-review/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-05T20:06:49Z"
        tlp = "TLP:CLEAR"
        indicator_count = "24"
    strings:
        $s0 = "and.to" ascii wide nocase  // Domains
        $s1 = "download.anydesk.com" ascii wide nocase  // Domains
        $s2 = "security.properties" ascii wide nocase  // Domains
        $s3 = "sendit.sh" ascii wide nocase  // Domains
        $s4 = "https://download.anydesk.com/AnyDesk.exe" ascii wide nocase  // URLs
        $s5 = "https://sendit.sh/Gg7Rp/ace.exe" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "02526fea432069eb90279c4e300ea44bf46eaf432a95b05e8a59b55a0c5c001b" or
        hash.sha256(0, filesize) == "03ce77aaed2c8dd8e28b76eb314ee3f5c18b4f13968e5edcb7be469a8faf1c59" or
        hash.sha256(0, filesize) == "083e52d55a27724f3f8829537937f80b3977568c27d933cb8f89b61ddc1be9d4" or
        hash.sha256(0, filesize) == "0c915094bbf9f6e768e0d12dc9a8005a52594cc0760262010c1cc03861b472aa" or
        hash.sha256(0, filesize) == "2996de9a85cc5f071df126539d8af8c12b72a46146021a06e15e53aceb5f83c1" or
        hash.sha256(0, filesize) == "2b6abda60be63d42053f3625c52b65ab45ed29b1226de7944b8724520d579ecf" or
        hash.sha256(0, filesize) == "51585ee73b70362da3739b8ec77f79336a5c5db9bddcde3fd49ccfe953b529a1" or
        hash.sha256(0, filesize) == "61512014718d1fc2d655c298b7a78bb3ec2ee411470cb57c7df6dfbbebc782cc" or
        hash.sha256(0, filesize) == "68858979b4db69e7c4dc41f2d50ea2642a087855601bdb7f33d8a294c259fbdb" or
        hash.sha256(0, filesize) == "6f320956b05b7b29fa2943f6a1af488a48c8a69b42a09d1f0e6d2f6b8183fe23" or
        hash.sha256(0, filesize) == "9375a9c3cf84140a1d8e21b72d3d2c57d85d4de09ea9ae1dc021b64732427da7" or
        hash.sha256(0, filesize) == "939962a7e660e7bd90dd50e28bce2a337562140813f885c42cf792a2877d05e6" or
        hash.sha256(0, filesize) == "9f12cc0b4cf009f01c1daba3d227e5a122c163e919517d25b01d4cada235d630" or
        hash.sha256(0, filesize) == "b655928dda17d138aea14f8a150eb0ff509d7676b33b1b569a9f853319ffd7cc" or
        hash.sha256(0, filesize) == "ba81e871ca20d688dd26fc950abaa49fb5ccb71a6dce3be97736256f644c0633" or
        hash.sha256(0, filesize) == "bcbe7b2c2d6463b146ec870c9e584e4e404d15756ce822c9277539848d870259" or
        hash.sha256(0, filesize) == "cc010e42b0e94fe67a973a9b8303848f1ee9028b06d78ae9256daf43611b225e" or
        hash.sha256(0, filesize) == "ebfea162e52b9f2768b15077647b78d3808473932c4c951f6e82ff9040ca8ced"
}