import "hash"

rule bulwark_https_bulwarkblack_com_teampcp_deploys_canisterworm_wiper_to_target_iranian_systems
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/teampcp-deploys-canisterworm-wiper-to-target-iranian-systems/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:29Z"
        tlp = "TLP:CLEAR"
        indicator_count = "99"
    strings:
        $s0 = "aquasecurtiy.org" ascii wide nocase  // Domains
        $s1 = "plug-tab-protective-relay.trycloudflare.com" ascii wide nocase  // Domains
        $s2 = "scan.aquasecurtiy.org" ascii wide nocase  // Domains
        $s3 = "tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io" ascii wide nocase  // Domains
        $s4 = "https://scan.aquasecurtiy.org" ascii wide nocase  // URLs
        $s5 = "https://tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io/" ascii wide nocase  // URLs
        $s6 = "45.148.10.212" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "0891663bc55073747be0eb864fbec3727840945d" or
        hash.sha1(0, filesize) == "0d49ceb356f7d4735c63bd0d5c7e67665ec7f80c" or
        hash.sha1(0, filesize) == "18f01febc4c3cd70ce6b94b70e69ab866fc033f5" or
        hash.sha1(0, filesize) == "19851bef764b57ff95b35e66589f31949eeb229d" or
        hash.sha1(0, filesize) == "1d74e4cf63b7cf083cf92bf5923cf037f7011c6b" or
        hash.sha1(0, filesize) == "2297a1b967ecc05ba2285eb6af56ab4da554ecae" or
        hash.sha1(0, filesize) == "22e864e71155122e2834eb0c10d0e7e0b8f65aa3" or
        hash.sha1(0, filesize) == "252554b0e1130467f4301ba65c55a9c373508e35" or
        hash.sha1(0, filesize) == "276ca9680f6df9016db12f7c48571e5c4639451d" or
        hash.sha1(0, filesize) == "2a51c5c5bb1fd1f0e134c9754f1702cfa359c3dd" or
        hash.sha1(0, filesize) == "2b1dac84ff12ba56158b3a97e2941a587cb20da9" or
        hash.sha1(0, filesize) == "2e7964d59cd24d1fd2aa4d6a5f93b7f09ea96947" or
        hash.sha1(0, filesize) == "3201ddddd69a1419c6f1511a14c5945ba3217126" or
        hash.sha1(0, filesize) == "384add36b52014a0f99c0ab3a3d58bd47e53d00f" or
        hash.sha1(0, filesize) == "38623bf26706d51c45647909dcfb669825442804" or
        hash.sha1(0, filesize) == "386c0f18ac3d7f2ed33e2d884761119f4024ff8a" or
        hash.sha1(0, filesize) == "3c615ac0f29e743eda8863377f9776619fd2db76" or
        hash.sha1(0, filesize) == "3d1b5be1589a83fc98b82781c263708b2eb3b47b" or
        hash.sha1(0, filesize) == "3dffed04dc90cf1c548f40577d642c52241ec76c" or
        hash.sha1(0, filesize) == "405e91f329294fb696f55793203abf1f6aba9b40" or
        hash.sha1(0, filesize) == "4209dcadeaea6a7df69262fef1beeda940881d4d" or
        hash.sha1(0, filesize) == "4bdcc5d9ef3ddb42ccc9126e6c07faa3df2807e3" or
        hash.sha1(0, filesize) == "506d7ff06abc509692c600b5b69b4dc6ceaa4b15" or
        hash.sha1(0, filesize) == "555e7ad4c895c558c7214496df1cd56d1390c516" or
        hash.sha1(0, filesize) == "61fbe20b7589e6b61eedcd5fe1e958e1a95fbd13" or
        hash.sha1(0, filesize) == "66c90331c8b991e7895d37796ac712b5895dda3b" or
        hash.sha1(0, filesize) == "6d8d730153d6151e03549f276faca0275ed9c7b2" or
        hash.sha1(0, filesize) == "6ec7aaf336b7d2593d980908be9bc4fed6d407c6" or
        hash.sha1(0, filesize) == "6fc874a1f9d65052d4c67a314da1dae914f1daff" or
        hash.sha1(0, filesize) == "7550f14b64c1c724035a075b36e71423719a1f30" or
        hash.sha1(0, filesize) == "794b6d99daefd5e27ecb33e12691c4026739bf98" or
        hash.sha1(0, filesize) == "7a4b6f31edb8db48cc22a1d41e298b38c4a6417e" or
        hash.sha1(0, filesize) == "7b955a5ece1e1b085c12dac7ac10e0eb1f5b0d4d" or
        hash.sha1(0, filesize) == "7f6f0ce52a59bdfc5757c3982aac2353b58f4c73" or
        hash.sha1(0, filesize) == "820428afeb64484d311211658383ce7f79d31a0a" or
        hash.sha1(0, filesize) == "848d665ed24dc1a41f6b4b7c7ffac7693d6b37be" or
        hash.sha1(0, filesize) == "8519037888b189f13047371758f7aed2283c6b58" or
        hash.sha1(0, filesize) == "85cb72f1e8ee5e6e44488cd6cbdbca94722f96ed" or
        hash.sha1(0, filesize) == "8aa8af3ea1de8e968a3e49a40afb063692ab8eae" or
        hash.sha1(0, filesize) == "8ae5a08aec3013ee8f6132b2a9012b45002f8eaa" or
        hash.sha1(0, filesize) == "8afa9b9f9183b4e00c46e2b82d34047e3c177bd0" or
        hash.sha1(0, filesize) == "8cfb9c31cc944da57458555aa398bb99336d5a1f" or
        hash.sha1(0, filesize) == "9092287c0339a8102f91c5a257a7e27625d9d029" or
        hash.sha1(0, filesize) == "91d5e0a13afab54533a95f8019dd7530bd38a071" or
        hash.sha1(0, filesize) == "91e7c2c36dcad14149d8e455b960af62a2ffb275" or
        hash.sha1(0, filesize) == "9738180dd24427b8824445dbbc23c30ffc1cb0d8" or
        hash.sha1(0, filesize) == "985447b035c447c1ed45f38fad7ca7a4254cb668" or
        hash.sha1(0, filesize) == "99b93c070aac11b52dfc3e41a55cbb24a331ae75" or
        hash.sha1(0, filesize) == "9ba3c3cd3b23d033cd91253a9e61a4bf59c8a670" or
        hash.sha1(0, filesize) == "9c000ba9d482773cbbc2c3544d61b109bc9eb832" or
        hash.sha1(0, filesize) == "9e8968cb83234f0de0217aa8c934a68a317ee518" or
        hash.sha1(0, filesize) == "a5b4818debf2adbaba872aaffd6a0f64a26449fa" or
        hash.sha1(0, filesize) == "a9bc513ea7989e3234b395cafb8ed5ccc3755636" or
        hash.sha1(0, filesize) == "aa3c46a9643b18125abb8aefc13219014e9c4be8" or
        hash.sha1(0, filesize) == "ab6606b76e5a054be08cab3d07da323e90e751e8" or
        hash.sha1(0, filesize) == "ad623e14ebdfe82b9627811d57b9a39e283d6128" or
        hash.sha1(0, filesize) == "b7252377a3d82c73d497bfafa3eabe84de1d02c4" or
        hash.sha1(0, filesize) == "b745a35bad072d93a9b83080e9920ec52c6b5a27" or
        hash.sha1(0, filesize) == "b7befdc106c600585d3eec87d7e98e1c136839ae" or
        hash.sha1(0, filesize) == "b9faa60f85f6f780a34b8d0faaf45b3e3966fdda" or
        hash.sha1(0, filesize) == "bb75a9059c2d5803db49e6ed6c6f7e0b367f96be" or
        hash.sha1(0, filesize) == "c19401b2f58dc6d2632cb473d44be98dd8292a93" or
        hash.sha1(0, filesize) == "c5967f85626795f647d4bf6eb67227f9b79e02f5" or
        hash.sha1(0, filesize) == "cf1692a1fc7a47120e6508309765db7e33477946" or
        hash.sha1(0, filesize) == "cf19d27c8a7fb7a8bbf1e1000e9318749bcd82cf" or
        hash.sha1(0, filesize) == "d488f4388ff4aa268906e25c2144f1433a4edec2" or
        hash.sha1(0, filesize) == "da73ae0790e458e878b300b57ceb5f81ac573b46" or
        hash.sha1(0, filesize) == "ddb6697447a97198bdef9bae00215059eb5e8bc2" or
        hash.sha1(0, filesize) == "ddb94181dcbc723d96ffc07fddd14d97e4849016" or
        hash.sha1(0, filesize) == "ddb9da4475c1cef7d5389062bdfdfbdbd1394648" or
        hash.sha1(0, filesize) == "e0198fd2b6e1679e36d32933941182d9afa82f6f" or
        hash.sha1(0, filesize) == "e53b0483d08da44da9dfe8a84bf2837e5163699b" or
        hash.sha1(0, filesize) == "ea56cd31d82b853932d50f1144e95b21817e52cf" or
        hash.sha1(0, filesize) == "ef3a510e3f94df3ea9fcd01621155ca5f2c3bf5b" or
        hash.sha1(0, filesize) == "f4436225d8a5fd1715d3c2290d8a50643e726031" or
        hash.sha1(0, filesize) == "f4f1785be270ae13f36f6a8cfbf6faaae50e660a" or
        hash.sha1(0, filesize) == "f5c9fd927027beaa3760d2a84daa8b00e6e5ee21" or
        hash.sha1(0, filesize) == "f77738448eec70113cf711656914b61905b3bd47" or
        hash.sha1(0, filesize) == "fa4209b6182a4c1609ce34d40b67f5cfd7f00f53" or
        hash.sha1(0, filesize) == "fa78e67c0df002c509bcdea88677fb5e2fe6a9b1" or
        hash.sha1(0, filesize) == "fd090040b5f584f4fcbe466878cb204d0735dcf4" or
        hash.sha1(0, filesize) == "fd429cf86db999572f3d9ca7c54561fdf7d388a4" or
        hash.sha256(0, filesize) == "0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e349" or
        hash.sha256(0, filesize) == "6328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538" or
        hash.sha256(0, filesize) == "822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0" or
        hash.sha256(0, filesize) == "887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073" or
        hash.sha256(0, filesize) == "bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7" or
        hash.sha256(0, filesize) == "d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94c" or
        hash.sha256(0, filesize) == "e6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243" or
        hash.sha256(0, filesize) == "e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecf" or
        hash.sha256(0, filesize) == "ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c" or
        hash.sha256(0, filesize) == "f7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d"
}