import "hash"

rule bulwark_https_bulwarkblack_com_solyximmortal_python_infostealer_business_risk
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/solyximmortal-python-infostealer-business-risk/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:21Z"
        tlp = "TLP:CLEAR"
        indicator_count = "7"
    strings:
        $s0 = "socprime.com" ascii wide nocase  // Domains
        $s1 = "www.cyfirma.com" ascii wide nocase  // Domains
        $s2 = "https://socprime.com/active-threats/solyximmortal-python-malware-analysis/" ascii wide nocase  // URLs
        $s3 = "https://www.cyfirma.com/research/solyximmortal-python-malware-analysis/" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "2690f7c685784fff006fe451fa3b154c" or
        hash.sha1(0, filesize) == "81c66c043982cfee9e60ae94203f4336da0b50c0" or
        hash.sha256(0, filesize) == "5a1b440861ef652cc207158e7e129f0b3a22ed5ef5d2ea5968e1d9eff33017bc"
}