import "hash"

rule bulwark_https_bulwarkblack_com_stopandprotect_wordpress_sites_clickfix_ransomware_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/stopandprotect-wordpress-sites-clickfix-ransomware-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:18Z"
        tlp = "TLP:CLEAR"
        indicator_count = "36"
    strings:
        $s0 = "co.uk" ascii wide nocase  // Domains
        $s1 = "com.ua" ascii wide nocase  // Domains
        $s2 = "discherniation.com" ascii wide nocase  // Domains
        $s3 = "ksr-racingparts.com" ascii wide nocase  // Domains
        $s4 = "lapellelaser.pl" ascii wide nocase  // Domains
        $s5 = "maximumrock.ro" ascii wide nocase  // Domains
        $s6 = "mectcalcutta.com" ascii wide nocase  // Domains
        $s7 = "norakremer.co.uk" ascii wide nocase  // Domains
        $s8 = "parsrulman.com" ascii wide nocase  // Domains
        $s9 = "pharmart.ae" ascii wide nocase  // Domains
        $s10 = "platinumcar.ca" ascii wide nocase  // Domains
        $s11 = "v-k.com.ua" ascii wide nocase  // Domains
        $s12 = "www.lapellelaser.pl" ascii wide nocase  // Domains
        $s13 = "www.parsrulman.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40" or
        hash.sha256(0, filesize) == "10babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c0" or
        hash.sha256(0, filesize) == "11a635d70444605ede1de0aa227a9fd7cfa4554e75bea93ce18b639ca571a42e" or
        hash.sha256(0, filesize) == "23cbabfe3ca3a7f1eb365f772d6a4ed8095cb8f7755622cc82e804478259dc70" or
        hash.sha256(0, filesize) == "2adbb2c206be7f23bf77f8f50d1ac0f809511c0b4591421931f81a6eaa42c68c" or
        hash.sha256(0, filesize) == "38602b76f6c65644b01fa4d81708251c159a883253cda8876396dc7212324ab9" or
        hash.sha256(0, filesize) == "3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8" or
        hash.sha256(0, filesize) == "3ed8f2cc8da4853fd770ff38f0cbce6d9d4a84e75a828fc0cec3e3ec60db94f9" or
        hash.sha256(0, filesize) == "4dee2fe98d4da75ffb259c03b50202212dafc85691429a28641a8068eddea504" or
        hash.sha256(0, filesize) == "65550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143" or
        hash.sha256(0, filesize) == "712e557373fba45bdd66d52e395b8af7ccf7006e6e82d4e1db0736e738d0d4fb" or
        hash.sha256(0, filesize) == "7d3604d0728b242c72bd144b8661ebf63c1042a4f5dd441bc8c8507c701df20c" or
        hash.sha256(0, filesize) == "8337bf29100a5871b1275227006dc2a43b21b751e5ce7e2032364fd78af59ac5" or
        hash.sha256(0, filesize) == "8d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab4" or
        hash.sha256(0, filesize) == "9765b1342cc7eb982a73bb1f94c6c500b63dc817073b76ea926c1097078d3527" or
        hash.sha256(0, filesize) == "976cfa57e1efacbe517b7e3441e9473d275ec1d9ad8ab69ddf8ae3a966aaa153" or
        hash.sha256(0, filesize) == "99bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940b" or
        hash.sha256(0, filesize) == "b3dff910b350ace27d64cbd79405cb154a1967e366d7b88170c3e8303b1d08ad" or
        hash.sha256(0, filesize) == "b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489" or
        hash.sha256(0, filesize) == "cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0" or
        hash.sha256(0, filesize) == "cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9" or
        hash.sha256(0, filesize) == "f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41"
}