import "hash"

rule bulwark_https_bulwarkblack_com_pawsrunner_steganography_purelogs_infostealer_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/pawsrunner-steganography-purelogs-infostealer-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:25:29Z"
        tlp = "TLP:CLEAR"
        indicator_count = "10"
    strings:
        $s0 = "everycarebd.com" ascii wide nocase  // Domains
        $s1 = "xverse.app" ascii wide nocase  // Domains
        $s2 = "https://everycarebd.com/imagelkjh0987.png" ascii wide nocase  // URLs
        $s3 = "5.101.84.202" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e" or
        hash.sha256(0, filesize) == "1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f9" or
        hash.sha256(0, filesize) == "6910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b9" or
        hash.sha256(0, filesize) == "8d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd588" or
        hash.sha256(0, filesize) == "93724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6e" or
        hash.sha256(0, filesize) == "e2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec"
}