import "hash"

rule bulwark_https_bulwarkblack_com_safepay_joint_advisory_backup_recovery_independence
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/safepay-joint-advisory-backup-recovery-independence/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-22T20:05:24Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "stopransomware.gov" ascii wide nocase  // Domains
        $s1 = "104.26.2.223" ascii wide nocase  // IPv4
        $s2 = "140.82.114.4" ascii wide nocase  // IPv4
        $s3 = "167.235.225.149" ascii wide nocase  // IPv4
        $s4 = "173.194.194.94" ascii wide nocase  // IPv4
        $s5 = "185.199.108.133" ascii wide nocase  // IPv4
        $s6 = "37.10.71.188" ascii wide nocase  // IPv4
        $s7 = "5.255.11.134" ascii wide nocase  // IPv4
        $s8 = "77.37.49.40" ascii wide nocase  // IPv4
        $s9 = "88.119.167.239" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "07353237350c35d6dc2c8f143b649cd07c71f62b" or
        hash.sha1(0, filesize) == "b498a2683640c983bb069fa2ea9e67cef4a3797d" or
        hash.sha1(0, filesize) == "bbfed53e3bb1f306f4da97d995cf4ae5b73ad081" or
        hash.sha1(0, filesize) == "d711a5af5aed48a3b36b98f4fcf52809aebef7a2" or
        hash.sha256(0, filesize) == "327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917" or
        hash.sha256(0, filesize) == "6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a" or
        hash.sha256(0, filesize) == "921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae" or
        hash.sha256(0, filesize) == "a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526" or
        hash.sha256(0, filesize) == "bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41" or
        hash.sha256(0, filesize) == "e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346"
}