import "hash"

rule bulwark_https_bulwarkblack_com_signed_clickonce_fake_interview_credential_theft_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/signed-clickonce-fake-interview-credential-theft-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:08Z"
        tlp = "TLP:CLEAR"
        indicator_count = "28"
    strings:
        $s0 = "apidrive.online" ascii wide nocase  // Domains
        $s1 = "auth3gapi.online" ascii wide nocase  // Domains
        $s2 = "diegovalanire.digital" ascii wide nocase  // Domains
        $s3 = "gapiauth.info" ascii wide nocase  // Domains
        $s4 = "gapiauth.net" ascii wide nocase  // Domains
        $s5 = "gapiconnect.com" ascii wide nocase  // Domains
        $s6 = "gapidriver.com" ascii wide nocase  // Domains
        $s7 = "gapioath.com" ascii wide nocase  // Domains
        $s8 = "www.dropbox.com" ascii wide nocase  // Domains
        $s9 = "https://diegovalanire.digital" ascii wide nocase  // URLs
        $s10 = "https://gapidriver.com/api/get.php" ascii wide nocase  // URLs
        $s11 = "https://gapidriver.com/api/rest.php" ascii wide nocase  // URLs
        $s12 = "https://gapidriver.com/installer/GapiUpdate.application" ascii wide nocase  // URLs
        $s13 = "https://www.dropbox.com/scl/fi/vwtoo632m1y8sqnm5vplm/Razo.rar?...&dl=1" ascii wide nocase  // URLs
        $s14 = "1.0.0.182" ascii wide nocase  // IPv4
        $s15 = "1.0.0.201" ascii wide nocase  // IPv4
        $s16 = "31.76.7.137" ascii wide nocase  // IPv4
        $s17 = "45.125.67.42" ascii wide nocase  // IPv4
        $s18 = "91.219.238.169" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "4d6abbfc7c052cbafaa53659971ac471" or
        hash.sha1(0, filesize) == "12730a7dd9af98f14441d476c10eb346708c1194" or
        hash.sha256(0, filesize) == "112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc" or
        hash.sha256(0, filesize) == "487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806" or
        hash.sha256(0, filesize) == "7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5" or
        hash.sha256(0, filesize) == "839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72" or
        hash.sha256(0, filesize) == "99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a" or
        hash.sha256(0, filesize) == "a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a" or
        hash.sha256(0, filesize) == "fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd"
}