import "hash"

rule bulwark_https_bulwarkblack_com_shadowhs_fileless_linux_post_exploitation_framework_runs_entirely
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/shadowhs-fileless-linux-post-exploitation-framework-runs-entirely-in-memory/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "35"
    strings:
        $s0 = "kawpow.asia" ascii wide nocase  // Domains
        $s1 = "kawpow.asia.mine.zergpool.com" ascii wide nocase  // Domains
        $s2 = "kawpow.eu" ascii wide nocase  // Domains
        $s3 = "kawpow.eu.mine.zergpool.com" ascii wide nocase  // Domains
        $s4 = "kawpow.na" ascii wide nocase  // Domains
        $s5 = "kawpow.na.mine.zergpool.com" ascii wide nocase  // Domains
        $s6 = "zergpool.com" ascii wide nocase  // Domains
        $s7 = "204.93.253.180" ascii wide nocase  // IPv4
        $s8 = "62.171.153.47" ascii wide nocase  // IPv4
        $s9 = "91.92.242.200" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "04a072481ebda2aa8f9e0dac371847f210199a503bf31950d796901d5dbe9d58" or
        hash.sha256(0, filesize) == "072e08b38a18a00d75b139a5bbb18ac4aa891f4fd013b55bfd3d6747e1ba0a27" or
        hash.sha256(0, filesize) == "0bb7d4d8a9c8f6b3622d07ae9892aa34dc2d0171209e2829d7d39d5024fd79ef" or
        hash.sha256(0, filesize) == "148f199591b9a696197ec72f8edb0cf4f90c5dcad0805cfab4a660f65bf27ef3" or
        hash.sha256(0, filesize) == "19df5436972b330910f7cb9856ef5fb17320f50b6ced68a76faecddcafa7dcd7" or
        hash.sha256(0, filesize) == "20c1819c2fb886375d9504b0e7e5debb87ec9d1a53073b1f3f36dd6a6ac3f427" or
        hash.sha256(0, filesize) == "3ba88f92a87c0bb01b13754190c36d8af7cd047f738ebb3d6f975960fe7614d6" or
        hash.sha256(0, filesize) == "3f014aa3e339d33760934f180915045daf922ca8ae07531c8e716608e683d92d" or
        hash.sha256(0, filesize) == "4069eaadc94efb5be43b768c47d526e4c080b7d35b4c9e7eeb63b8dcf0038d7d" or
        hash.sha256(0, filesize) == "574a17028b28fdf860e23754d16ede622e4e27bac11d33dbf5c39db501dfccdc" or
        hash.sha256(0, filesize) == "5a6b08d42cc8296b32034b132bab18d201a48c1628df3200e869722506dd4ec6" or
        hash.sha256(0, filesize) == "662d4e58e95b7b27eb961f3d81d299af961892c74bc7a1f2bb7a8f2442030d0e" or
        hash.sha256(0, filesize) == "666122c39b2fd4499678105420e21b938f0f62defdbc85275e14156ae69539d6" or
        hash.sha256(0, filesize) == "6c50fcf14af7f984a152016498bf4096dd1f71e9d35000301b8319bd50f7f6d0" or
        hash.sha256(0, filesize) == "72023e9829b0de93cf9f057858cac1bcd4a0499b018fb81406e08cd3053ae55b" or
        hash.sha256(0, filesize) == "7361c6861fdb08cab819b13bf2327bc82eebdd70651c7de1aed18515c1700d97" or
        hash.sha256(0, filesize) == "7fbab71fcc454401f6c3db91ed0afb0027266d5681c23900894f1002ceca389a" or
        hash.sha256(0, filesize) == "8007b94d367b7dbacaac4c1da0305b489f0f3f7a38770dcdb68d5824fe33d041" or
        hash.sha256(0, filesize) == "847846a0f0c76cf5699342a066378774f1101d2fb74850e3731dc9b74e12a69d" or
        hash.sha256(0, filesize) == "9f2cfc65b480695aa2fd847db901e6b1135b5ed982d9942c61b629243d6830dd" or
        hash.sha256(0, filesize) == "9fdaf64180b7d02b399d2a92f1cdd062af2e6584852ea597c50194b62cca3c0b" or
        hash.sha256(0, filesize) == "b3ee445675fce1fccf365a7b681b316124b1a5f0a7e87042136e91776b187f39" or
        hash.sha256(0, filesize) == "c679b408275f9624602702f5601954f3b51efbb1acc505950ee88175854e783f" or
        hash.sha256(0, filesize) == "e11bcba19ac628ae1d0b56e43646ae1b5da2ccc1da5162e6719d4b7d68d37096" or
        hash.sha256(0, filesize) == "e5a6deec56095d0ae702655ea2899c752f4a0735f9077605d933a04d45cd7e24"
}