import "hash"

rule bulwark_https_bulwarkblack_com_uat_9244_china_nexus_apt_deploys_three_new_malware_implants_again
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/uat-9244-china-nexus-apt-deploys-three-new-malware-implants-against-south-american-telecom-providers/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "72"
    strings:
        $s0 = "bloopencil.net" ascii wide nocase  // Domains
        $s1 = "xcit76.com" ascii wide nocase  // Domains
        $s2 = "xtibh.com" ascii wide nocase  // Domains
        $s3 = "149.28.25.33" ascii wide nocase  // IPv4
        $s4 = "154.205.154.194" ascii wide nocase  // IPv4
        $s5 = "154.205.154.65" ascii wide nocase  // IPv4
        $s6 = "154.205.154.70" ascii wide nocase  // IPv4
        $s7 = "154.205.154.82" ascii wide nocase  // IPv4
        $s8 = "154.223.21.130" ascii wide nocase  // IPv4
        $s9 = "154.223.21.194" ascii wide nocase  // IPv4
        $s10 = "158.247.238.240" ascii wide nocase  // IPv4
        $s11 = "185.196.10.247" ascii wide nocase  // IPv4
        $s12 = "185.196.10.38" ascii wide nocase  // IPv4
        $s13 = "207.148.120.52" ascii wide nocase  // IPv4
        $s14 = "207.148.121.95" ascii wide nocase  // IPv4
        $s15 = "212.11.64.105" ascii wide nocase  // IPv4
        $s16 = "216.238.112.222" ascii wide nocase  // IPv4
        $s17 = "216.238.123.242" ascii wide nocase  // IPv4
        $s18 = "216.238.94.37" ascii wide nocase  // IPv4
        $s19 = "38.54.125.134" ascii wide nocase  // IPv4
        $s20 = "38.60.199.34" ascii wide nocase  // IPv4
        $s21 = "45.32.106.94" ascii wide nocase  // IPv4
        $s22 = "45.77.34.194" ascii wide nocase  // IPv4
        $s23 = "45.77.41.141" ascii wide nocase  // IPv4
        $s24 = "47.76.100.159" ascii wide nocase  // IPv4
        $s25 = "64.190.113.170" ascii wide nocase  // IPv4
        $s26 = "64.95.10.253" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "2b170a6d90fceba72aba3c7bc5c40b9725f43788" or
        hash.sha256(0, filesize) == "00735a8a50d2856c11150ef1e29c05acebce7ad3edad00e37c7f043aacb46330" or
        hash.sha256(0, filesize) == "023467e236a95d5f0e62e26445d430d749c59312f66cf136e6e2c2d526c46ba1" or
        hash.sha256(0, filesize) == "03eac9eb7f4b4bc494ef0496ee23cabbf38f883896838ed813741d8f64ac9fde" or
        hash.sha256(0, filesize) == "06b23d84fd7afd525dfd7860ebd561dcdd72ccbeb51981d5d9a75acf068d0a2a" or
        hash.sha256(0, filesize) == "075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e744" or
        hash.sha256(0, filesize) == "0c7e36683a100a96f695a952cf07052af9a47f5898e1078311fd58c5fdbdecc8" or
        hash.sha256(0, filesize) == "15d937803f90c2b9e277ff94d3e98ff30015ecc7f4623a158e3c98861e5cb278" or
        hash.sha256(0, filesize) == "17652d7bb5fe0454023db4fc7f608df0dbe6af237be31258e16ba52f0e895e26" or
        hash.sha256(0, filesize) == "1cedf01dd4b7e50181d0e781825c66957b862941395d77c8bd7705114f319c80" or
        hash.sha256(0, filesize) == "1f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b" or
        hash.sha256(0, filesize) == "1fcdd5a417db31e5e07d32cecfa69e53f0dce95b7130ad9c03b92249f001801d" or
        hash.sha256(0, filesize) == "2c3f2261b00ea45e25eb4e9de2b7ff8e41f311c0b3d986461f834022c08b3b99" or
        hash.sha256(0, filesize) == "2d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f0538" or
        hash.sha256(0, filesize) == "34d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e91" or
        hash.sha256(0, filesize) == "38eeaa4eaad72feb3f8e6993565fcc548d8e7bb93642590f00fa24aacc0e2862" or
        hash.sha256(0, filesize) == "3c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff" or
        hash.sha256(0, filesize) == "3d9fbfc2c056eac857ba54e5ed134aa45a4b8322ee9f9353ba32e5b2ca71b0e3" or
        hash.sha256(0, filesize) == "3fcadde4b414a18b2fed56c1ec59d97977123615fbbf411a1c78425445a6e71c" or
        hash.sha256(0, filesize) == "3fcced9332301ff70b20c98c9434c858400013d659afa6bb5149cffb0206357d" or
        hash.sha256(0, filesize) == "56bead2933e91366e4a0d5761daf5b238a7f2c22e597664ef67b3ecae20ab326" or
        hash.sha256(0, filesize) == "66adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d011611" or
        hash.sha256(0, filesize) == "66bdce93de3b02cf9cdadad18ca1504ac83e379a752d51f60deae6dcbafe4e31" or
        hash.sha256(0, filesize) == "66ce42258062e902bd7f9e90ad5453a901cfc424f0ea497c4d14f063f3acd329" or
        hash.sha256(0, filesize) == "6a2d23cc8746a83e9a3b974788fce0e414706b8e75ff390426dd7e10b19967b3" or
        hash.sha256(0, filesize) == "6ec070457d1f6f239cb02c5e1576a3660cca98f3a07eec6e4e107f698d7fe555" or
        hash.sha256(0, filesize) == "711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada289" or
        hash.sha256(0, filesize) == "74d1a678bdc4bb9f33321e94e3bd1bc1740472ed734231fc46af720072ecb77e" or
        hash.sha256(0, filesize) == "74fbc8360d4c95d64d7acaa4d18943dce2d41f91d080b0b5e435d8bce52861a5" or
        hash.sha256(0, filesize) == "7b70cd956f082b1029d02b4cb7608893f2de7fa9c500d7d7febdd0f745ac3cb6" or
        hash.sha256(0, filesize) == "870e791af14caaf395c56028176a9c3f4c1ff0318ef3112d57ecd3d4a1be2ef9" or
        hash.sha256(0, filesize) == "9a7225c17e4bad3ffe7f080530d36f4f8aca5c116b913caa91ab9b0cee85638e" or
        hash.sha256(0, filesize) == "a313f76fca50fff1bcd6f2c6cbc1268985f8c0a3a05fe7f43c4fc0ac3aff84dc" or
        hash.sha256(0, filesize) == "a5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3" or
        hash.sha256(0, filesize) == "babc81fc9c998e9dc4ab545f0e112e34d2641e1333bc81aaa131abd061a5b604" or
        hash.sha256(0, filesize) == "bfc35f12d00fa4b40c5fbce9e37d704e12a52262709bcbdf09f97890bc40cad5" or
        hash.sha256(0, filesize) == "c9a42423ef08bd7f183915780d39530eba5e4e25968c51965ff8bb3026965a28" or
        hash.sha256(0, filesize) == "c9fc2af30f769d856b88b3051f19fdb663b3e0a0916279df9bbcba93c6a110c9" or
        hash.sha256(0, filesize) == "d5eb979cb8a72706bfa591fa57d4ebf7d13cecdc9377b0192375e2f570f796df" or
        hash.sha256(0, filesize) == "d78b3c6df8f3756a7e310cf7435fdba201dd03ec9f97420a0db683489a01a7c9" or
        hash.sha256(0, filesize) == "e34c9159e6e78c59518a14c5b96bddfee094b684f99d4f69b13371284a014e87" or
        hash.sha256(0, filesize) == "ebcb2691b7c92cdf2b2ff5e2d753abeea8cb325c16596cd839e6bd147f80e38a" or
        hash.sha256(0, filesize) == "f36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02" or
        hash.sha256(0, filesize) == "f3e899789b56429f483e5096e1f473335024f1f763e2d428132338e30352b89e" or
        hash.sha256(0, filesize) == "f8066833e47814793d8c58743622b051070dac09cb010c323970c81b59260f84"
}