import "hash"

rule bulwark_https_bulwarkblack_com_showboat_jfmbackdoor_telecom_intrusion_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/showboat-jfmbackdoor-telecom-intrusion-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:06Z"
        tlp = "TLP:CLEAR"
        indicator_count = "14"
    strings:
        $s0 = "kaztelecom.shop" ascii wide nocase  // Domains
        $s1 = "singtelcom.site" ascii wide nocase  // Domains
        $s2 = "telecom.webredirect.org" ascii wide nocase  // Domains
        $s3 = "101.36.105.222" ascii wide nocase  // IPv4
        $s4 = "116.169.244.208" ascii wide nocase  // IPv4
        $s5 = "139.84.227.139" ascii wide nocase  // IPv4
        $s6 = "192.9.141.111" ascii wide nocase  // IPv4
        $s7 = "194.135.25.132" ascii wide nocase  // IPv4
        $s8 = "23.27.201.160" ascii wide nocase  // IPv4
        $s9 = "64.176.43.209" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "2229e7f3cabbce4d67cd79c89fd5a100b20e8a99f4a2bf9aac77a978f49eb520" or
        hash.sha256(0, filesize) == "27df475626aafce2ea1548a9f35efb9ad951298c8b11a6adb3ccdfcd5170c677" or
        hash.sha256(0, filesize) == "a72427af3c046fd90999a6505b2372dc4ffde122227f30ed21621ecd4f2d3e8b" or
        hash.sha256(0, filesize) == "e28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0"
}