import "hash"

rule bulwark_https_bulwarkblack_com_white_label_router_backdoors_edge_provenance
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/white-label-router-backdoors-edge-provenance/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T20:04:38Z"
        tlp = "TLP:CLEAR"
        indicator_count = "30"
    strings:
        $s0 = "ac-link.com" ascii wide nocase  // Domains
        $s1 = "api.vulncheck.com" ascii wide nocase  // Domains
        $s2 = "cswlink.com" ascii wide nocase  // Domains
        $s3 = "en.fofa.info" ascii wide nocase  // Domains
        $s4 = "findmyipaddr.com" ascii wide nocase  // Domains
        $s5 = "mqonu.com" ascii wide nocase  // Domains
        $s6 = "platform.censys.io" ascii wide nocase  // Domains
        $s7 = "r.co" ascii wide nocase  // Domains
        $s8 = "www.ac-link.com" ascii wide nocase  // Domains
        $s9 = "www.findmyipaddr.com" ascii wide nocase  // Domains
        $s10 = "www.shodan.io" ascii wide nocase  // Domains
        $s11 = "www.zoomeye.ai" ascii wide nocase  // Domains
        $s12 = "https://api.vulncheck.com/v3/index/target-intel?port=9992\\&transport=udp\\&classification=c2" ascii wide nocase  // URLs
        $s13 = "https://en.fofa.info/result?qbase64=Ym9keT0id2stbG9naW4taHRtbCI=" ascii wide nocase  // URLs
        $s14 = "https://en.fofa.info/result?qbase64=YmFubmVyPSIwOzBIV2VsY29tZSB0byBNUVdydEAi" ascii wide nocase  // URLs
        $s15 = "https://en.fofa.info/result?qbase64=YmFubmVyPSJTU0gtMi4wLWRyb3BiZWFyXzIwMTQuNjMiICYmICJlMGFjNmMwODM0OTdkMTllNWFiM2QyOGY5MzU0ZTdkODRiMzA3OTNlYmE3MjBjN2Y3OTNhZWIxY2E5YmU5YTQxIg==" ascii wide nocase  // URLs
        $s16 = "https://platform.censys.io/search?q=host.services.endpoints.http.body%3A%22wk-login-html%22" ascii wide nocase  // URLs
        $s17 = "https://platform.censys.io/search?q=host.services.ssh.server\\_host\\_key.fingerprint\\_sha256%3D%22e0ac6c083497d19e5ab3d28f9354e7d84b30793eba720c7f793aeb1ca9be9a41%22" ascii wide nocase  // URLs
        $s18 = "https://www.shodan.io/search?query=%220%3B0HWelcome+to+MQWrt%40%22" ascii wide nocase  // URLs
        $s19 = "https://www.shodan.io/search?query=ad%3A9a%3A52%3Aad%3A2b%3A05%3A7c%3Aca%3A13%3A7d%3A12%3Ac6%3Aa7%3Aa9%3A7e%3A79" ascii wide nocase  // URLs
        $s20 = "https://www.shodan.io/search?query=html%3A%22wk-login-html%22" ascii wide nocase  // URLs
        $s21 = "https://www.zoomeye.ai/searchResult?q=aHR0cC5ib2R5PSJ3ay1sb2dpbi1odG1sIg%3D%3D" ascii wide nocase  // URLs
        $s22 = "1.0.0.2" ascii wide nocase  // IPv4
        $s23 = "1.0.0.3" ascii wide nocase  // IPv4
        $s24 = "3.0.0.4" ascii wide nocase  // IPv4
        $s25 = "45.156.37.159" ascii wide nocase  // IPv4
        $s26 = "47.107.224.89" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245" or
        hash.sha256(0, filesize) == "ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926" or
        hash.sha256(0, filesize) == "b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818"
}