import "hash"

rule bulwark_https_bulwarkblack_com_tackling_anti_analysis_techniques_of_guloader_and_redline_stealer
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/tackling-anti-analysis-techniques-of-guloader-and-redline-stealer/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:36Z"
        tlp = "TLP:CLEAR"
        indicator_count = "2"
    condition:
        hash.sha256(0, filesize) == "32ea41ff050f09d0b92967588a131e0a170cb46baf7ee58d03277d09336f89d9" or
        hash.sha256(0, filesize) == "a4cf69f849e9ea0ab4eba1cdc1ef2a973591bc7bb55901fdbceb412fb1147ef9"
}