import "hash"

rule bulwark_https_bulwarkblack_com_sloppyrat_ransomware_infection_funnel_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/sloppyrat-ransomware-infection-funnel-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-10T15:10:40Z"
        tlp = "TLP:CLEAR"
        indicator_count = "32"
    strings:
        $s0 = "api.telephoneip.net" ascii wide nocase  // Domains
        $s1 = "api.truesmart.org" ascii wide nocase  // Domains
        $s2 = "finger.linked4x.com" ascii wide nocase  // Domains
        $s3 = "skipraid.com" ascii wide nocase  // Domains
        $s4 = "stro7121.blob.core.windows.net" ascii wide nocase  // Domains
        $s5 = "windows.net" ascii wide nocase  // Domains
        $s6 = "https://backup-ubt.s3.us-east-1.amazonaws.com/hostfxr.dll" ascii wide nocase  // URLs
        $s7 = "https://skipraid.com/dsVGmQTrzX/default2" ascii wide nocase  // URLs
        $s8 = "https://stro7121.blob.core.windows.net/dpp1/config.py" ascii wide nocase  // URLs
        $s9 = "https://stro7121.blob.core.windows.net/dpp1/hostfxr.dll" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec" or
        hash.sha256(0, filesize) == "1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd" or
        hash.sha256(0, filesize) == "2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2" or
        hash.sha256(0, filesize) == "3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19" or
        hash.sha256(0, filesize) == "466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8" or
        hash.sha256(0, filesize) == "4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56" or
        hash.sha256(0, filesize) == "518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064" or
        hash.sha256(0, filesize) == "607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9" or
        hash.sha256(0, filesize) == "680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21" or
        hash.sha256(0, filesize) == "6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013" or
        hash.sha256(0, filesize) == "7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7" or
        hash.sha256(0, filesize) == "8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990" or
        hash.sha256(0, filesize) == "93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490" or
        hash.sha256(0, filesize) == "971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d" or
        hash.sha256(0, filesize) == "9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a" or
        hash.sha256(0, filesize) == "a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316" or
        hash.sha256(0, filesize) == "bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd" or
        hash.sha256(0, filesize) == "c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189" or
        hash.sha256(0, filesize) == "cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189" or
        hash.sha256(0, filesize) == "eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d" or
        hash.sha256(0, filesize) == "f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb" or
        hash.sha256(0, filesize) == "ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5"
}