import "hash"

rule bulwark_https_bulwarkblack_com_zerobot_malware_targets_n8n_automation_platform_first_active_expl
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/zerobot-malware-targets-n8n-automation-platform-first-active-exploitation-of-cve-2025-68613/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:27:01Z"
        tlp = "TLP:CLEAR"
        indicator_count = "16"
    strings:
        $s0 = "0bot.qzz.io" ascii wide nocase  // Domains
        $s1 = "andro.notemacro.com" ascii wide nocase  // Domains
        $s2 = "notemacro.com" ascii wide nocase  // Domains
        $s3 = "pivot.notemacro.com" ascii wide nocase  // Domains
        $s4 = "qzz.io" ascii wide nocase  // Domains
        $s5 = "103.59.160.237" ascii wide nocase  // IPv4
        $s6 = "140.233.190.96" ascii wide nocase  // IPv4
        $s7 = "144.172.100.228" ascii wide nocase  // IPv4
        $s8 = "172.86.123.179" ascii wide nocase  // IPv4
        $s9 = "216.126.227.101" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57" or
        hash.sha256(0, filesize) == "360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4da" or
        hash.sha256(0, filesize) == "c8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111f" or
        hash.sha256(0, filesize) == "cc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24" or
        hash.sha256(0, filesize) == "d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7" or
        hash.sha256(0, filesize) == "deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060"
}