import "hash"

rule bulwark_https_bulwarkblack_com_python_maas_infostealer_builder_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/python-maas-infostealer-builder-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-28T15:15:51Z"
        tlp = "TLP:CLEAR"
        indicator_count = "5"
    strings:
        $s0 = "pastebin.com" ascii wide nocase  // Domains
        $s1 = "https://pastebin.com/api/api_post.php" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "429ed63ab3fbda8d22d0ac750ecfe8cc" or
        hash.md5(0, filesize) == "610f0c65a3f8e88559f89ed90ea9ee5c" or
        hash.md5(0, filesize) == "9ffe0e45c7a3f20e4481206c1c3b0854"
}