import "hash"

rule bulwark_https_bulwarkblack_com_bluenoroffs_ghostcall_and_ghosthire_campaigns_use_stolen_victim_v
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/bluenoroffs-ghostcall-and-ghosthire-campaigns-use-stolen-victim-videos-to-compromise-crypto-executives/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:32Z"
        tlp = "TLP:CLEAR"
        indicator_count = "168"
    strings:
        $s0 = "Backdoor.Python.Agent.br" ascii wide nocase  // Domains
        $s1 = "Crypto.com" ascii wide nocase  // Domains
        $s2 = "Trojan.Shell.Agent.gn" ascii wide nocase  // Domains
        $s3 = "autoupdate.online" ascii wide nocase  // Domains
        $s4 = "bots.autoupdate.online" ascii wide nocase  // Domains
        $s5 = "botsc.autoupdate.xyz" ascii wide nocase  // Domains
        $s6 = "check.datatabletemplate.shop" ascii wide nocase  // Domains
        $s7 = "chkactive.online" ascii wide nocase  // Domains
        $s8 = "cloud-server.store" ascii wide nocase  // Domains
        $s9 = "dataupload.store" ascii wide nocase  // Domains
        $s10 = "download.datatabletemplate.xyz" ascii wide nocase  // Domains
        $s11 = "download.face-online.world" ascii wide nocase  // Domains
        $s12 = "file-server.store" ascii wide nocase  // Domains
        $s13 = "filedrive.online" ascii wide nocase  // Domains
        $s14 = "first.longlastfor.online" ascii wide nocase  // Domains
        $s15 = "first.system-update.xyz" ascii wide nocase  // Domains
        $s16 = "firstfromsep.online" ascii wide nocase  // Domains
        $s17 = "flashserve.store" ascii wide nocase  // Domains
        $s18 = "group.com" ascii wide nocase  // Domains
        $s19 = "image-support.xyz" ascii wide nocase  // Domains
        $s20 = "instant-update.online" ascii wide nocase  // Domains
        $s21 = "metamask.awaitingfor.site" ascii wide nocase  // Domains
        $s22 = "pre.alwayswait.site" ascii wide nocase  // Domains
        $s23 = "readysafe.xyz" ascii wide nocase  // Domains
        $s24 = "real-update.xyz" ascii wide nocase  // Domains
        $s25 = "root.chkstate.online" ascii wide nocase  // Domains
        $s26 = "root.security-update.xyz" ascii wide nocase  // Domains
        $s27 = "safefor.xyz" ascii wide nocase  // Domains
        $s28 = "safeup.store" ascii wide nocase  // Domains
        $s29 = "safeupload.online" ascii wide nocase  // Domains
        $s30 = "second.awaitingfor.online" ascii wide nocase  // Domains
        $s31 = "second.systemupdate.cloud" ascii wide nocase  // Domains
        $s32 = "secondshop.online" ascii wide nocase  // Domains
        $s33 = "secondshop.store" ascii wide nocase  // Domains
        $s34 = "signsafe.site" ascii wide nocase  // Domains
        $s35 = "signsafe.xyz" ascii wide nocase  // Domains
        $s36 = "support.ms" ascii wide nocase  // Domains
        $s37 = "support.ms-live.us" ascii wide nocase  // Domains
        $s38 = "support.video-meeting.online" ascii wide nocase  // Domains
        $s39 = "swissborg.blog" ascii wide nocase  // Domains
        $s40 = "system.updatecheck.store" ascii wide nocase  // Domains
        $s41 = "urgent-update.cloud" ascii wide nocase  // Domains
        $s42 = "us.zoom.com" ascii wide nocase  // Domains
        $s43 = "web.commoncome.online" ascii wide nocase  // Domains
        $s44 = "web071zoom.us" ascii wide nocase  // Domains
        $s45 = "writeup.live" ascii wide nocase  // Domains
        $s46 = "zoom.app" ascii wide nocase  // Domains
        $s47 = "alwayswait.site" ascii wide nocase  // URLs
        $s48 = "autoupdate.xyz" ascii wide nocase  // URLs
        $s49 = "awaitingfor.online" ascii wide nocase  // URLs
        $s50 = "awaitingfor.site/update" ascii wide nocase  // URLs
        $s51 = "chkactive.online/update" ascii wide nocase  // URLs
        $s52 = "chkstate.online" ascii wide nocase  // URLs
        $s53 = "cloud-server.store/update" ascii wide nocase  // URLs
        $s54 = "commoncome.online" ascii wide nocase  // URLs
        $s55 = "datatabletemplate.shop" ascii wide nocase  // URLs
        $s56 = "datatabletemplate.xyz" ascii wide nocase  // URLs
        $s57 = "datatabletemplate.xyz/account/register/id=8118555902061899&amp" ascii wide nocase  // URLs
        $s58 = "dataupload.store/uploadfiles" ascii wide nocase  // URLs
        $s59 = "face-online.world" ascii wide nocase  // URLs
        $s60 = "file-server.store/update" ascii wide nocase  // URLs
        $s61 = "filedrive.online/uploadfiles" ascii wide nocase  // URLs
        $s62 = "firstfromsep.online/client" ascii wide nocase  // URLs
        $s63 = "flashserve.store/update" ascii wide nocase  // URLs
        $s64 = "http://web071zoom.us/fix/audio-fv/7217417464" ascii wide nocase  // URLs
        $s65 = "http://web071zoom.us/fix/audio-tr/7217417464" ascii wide nocase  // URLs
        $s66 = "http://web071zoom.us/fix/audio/4542828056" ascii wide nocase  // URLs
        $s67 = "https://bots.autoupdate.online:8080/test" ascii wide nocase  // URLs
        $s68 = "https://chkactive.online/update" ascii wide nocase  // URLs
        $s69 = "https://cloud-server.store/update" ascii wide nocase  // URLs
        $s70 = "https://dataupload.store/uploadfiles" ascii wide nocase  // URLs
        $s71 = "https://download.datatabletemplate.xyz/account/register/id=8118555902061899&secret=QwLoOZSDakFh" ascii wide nocase  // URLs
        $s72 = "https://file-server.store/update" ascii wide nocase  // URLs
        $s73 = "https://filedrive.online/uploadfiles" ascii wide nocase  // URLs
        $s74 = "https://flashserve.store/update" ascii wide nocase  // URLs
        $s75 = "https://metamask.awaitingfor.site/update" ascii wide nocase  // URLs
        $s76 = "https://safeup.store/test" ascii wide nocase  // URLs
        $s77 = "https://safeupload.online/uploadfiles" ascii wide nocase  // URLs
        $s78 = "https://support.ms-live.us/301631/check" ascii wide nocase  // URLs
        $s79 = "https://support.ms-live.us/register/22989524464UcX2b5w52" ascii wide nocase  // URLs
        $s80 = "https://support.ms-live.us/update/02583235891M49FYUN57" ascii wide nocase  // URLs
        $s81 = "https://urgent-update.cloud/uploadfiles" ascii wide nocase  // URLs
        $s82 = "https://writeup.live/test" ascii wide nocase  // URLs
        $s83 = "longlastfor.online" ascii wide nocase  // URLs
        $s84 = "ms-live.us/301631/check" ascii wide nocase  // URLs
        $s85 = "ms-live.us/register/22989524464UcX2b5w52" ascii wide nocase  // URLs
        $s86 = "ms-live.us/update/02583235891M49FYUN57" ascii wide nocase  // URLs
        $s87 = "safeup.store/test" ascii wide nocase  // URLs
        $s88 = "safeupload.online/uploadfiles" ascii wide nocase  // URLs
        $s89 = "security-update.xyz" ascii wide nocase  // URLs
        $s90 = "signsafe.xyz/update" ascii wide nocase  // URLs
        $s91 = "system-update.xyz" ascii wide nocase  // URLs
        $s92 = "systemupdate.cloud" ascii wide nocase  // URLs
        $s93 = "systemupdate.cloud/client" ascii wide nocase  // URLs
        $s94 = "updatecheck.store" ascii wide nocase  // URLs
        $s95 = "urgent-update.cloud/uploadfiles" ascii wide nocase  // URLs
        $s96 = "video-meeting.online" ascii wide nocase  // URLs
        $s97 = "web071zoom.us/fix/audio-fv/7217417464" ascii wide nocase  // URLs
        $s98 = "web071zoom.us/fix/audio-tr/7217417464" ascii wide nocase  // URLs
        $s99 = "web071zoom.us/fix/audio/4542828056" ascii wide nocase  // URLs
        $s100 = "writeup.live/test" ascii wide nocase  // URLs
        $s101 = "104.168.214.151" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "00dd47af3db45548d2722fe8a4489508" or
        hash.md5(0, filesize) == "01d3ed1c228f09d8e56bfbc5f5622a6c" or
        hash.md5(0, filesize) == "0af11f610da1f691e43173d44643283f" or
        hash.md5(0, filesize) == "0ca37675d75af0e7def0025cd564d6c5" or
        hash.md5(0, filesize) == "10cd1ef394bc2a2d8d8f2558b73ac7b8" or
        hash.md5(0, filesize) == "1243968876262c3ad4250e1371447b23" or
        hash.md5(0, filesize) == "1653d75d579872fadec1f22cf7fee3c0" or
        hash.md5(0, filesize) == "17baae144d383e4dc32f1bf69700e587" or
        hash.md5(0, filesize) == "19a7e16332a6860b65e6944f1f3c5001" or
        hash.md5(0, filesize) == "1ee10fa01587cec51f455ceec779a160" or
        hash.md5(0, filesize) == "261a409946b6b4d9ce706242a76134e3" or
        hash.md5(0, filesize) == "2b499eb3865a7ef17264d15252b7f73e" or
        hash.md5(0, filesize) == "2c42253ebf9a743814b9b16a89522bef" or
        hash.md5(0, filesize) == "31b88dd319af8e4b8a96fc9732ebc708" or
        hash.md5(0, filesize) == "358c2969041c8be74ce478edb2ffcd19" or
        hash.md5(0, filesize) == "389447013870120775556bb4519dba97" or
        hash.md5(0, filesize) == "38c8d80dd32d00e9c9440a498f7dd739" or
        hash.md5(0, filesize) == "3bbe4dfe3134c8a7928d10c948e20bee" or
        hash.md5(0, filesize) == "50f341b24cb75f37d042d1e5f9e3e5aa" or
        hash.md5(0, filesize) == "529fe6eff1cf452680976087e2250c02" or
        hash.md5(0, filesize) == "5ad40a5fd18a1b57b69c44bc2963dc6b" or
        hash.md5(0, filesize) == "5cb4f0084f3c25e640952753ed5b25d0" or
        hash.md5(0, filesize) == "60bfe4f378e9f5a84183ac505a032228" or
        hash.md5(0, filesize) == "6348b49f3499d760797247b94385fda3" or
        hash.md5(0, filesize) == "6422795a6df10c45c1006f92d686ee7e" or
        hash.md5(0, filesize) == "6aa93664b4852cb5bad84ba1a187f645" or
        hash.md5(0, filesize) == "7168ce5c6e5545a5b389db09c90038da" or
        hash.md5(0, filesize) == "73d26eb56e5a3426884733c104c3f625" or
        hash.md5(0, filesize) == "7581854ff6c890684823f3aed03c210f" or
        hash.md5(0, filesize) == "76ace3a6892c25512b17ed42ac2ebd05" or
        hash.md5(0, filesize) == "76ace3a6892c25512b17ed42ac2ebd05" or
        hash.md5(0, filesize) == "7e50c3f301dd045eb189ba1644ded155" or
        hash.md5(0, filesize) == "7f94ed2d5f566c12de5ebe4b5e3d8aa3" or
        hash.md5(0, filesize) == "8006efb8dd703073197e5a27682b35bf" or
        hash.md5(0, filesize) == "8f8942cd14f646f59729f83cbd4c357b" or
        hash.md5(0, filesize) == "931cec3c80c78d233e3602a042a2e71b" or
        hash.md5(0, filesize) == "9551b4af789b2db563f9452eaf46b6aa" or
        hash.md5(0, filesize) == "963f473f1734d8b3fbb8c9a227c06d07" or
        hash.md5(0, filesize) == "a070b77c5028d7a5d2895f1c9d35016f" or
        hash.md5(0, filesize) == "a0eb7e480752d494709c63aa35ccf36c" or
        hash.md5(0, filesize) == "a26f2b97ca4e2b4b5d58933900f02131" or
        hash.md5(0, filesize) == "a6ce961f487b4cbdfe68d0a249647c48" or
        hash.md5(0, filesize) == "ab1e8693931f8c694247d96cf5a85197" or
        hash.md5(0, filesize) == "b2e9a6412fd7c068a5d7c38d0afd946f" or
        hash.md5(0, filesize) == "b567bfdaac131a2d8a23ad8fd450a31d" or
        hash.md5(0, filesize) == "c42c7a2ea1c2f00dddb0cc4c8bfb5bcf" or
        hash.md5(0, filesize) == "c446682f33641cff21083ac2ce477dbe" or
        hash.md5(0, filesize) == "c6f0c8d41b9ad4f079161548d2435d80" or
        hash.md5(0, filesize) == "d63805e89053716b6ab93ce6decf8450" or
        hash.md5(0, filesize) == "d8529855fab4b4aa6c2b34449cb3b9fb" or
        hash.md5(0, filesize) == "de93e85199240de761a8ba0a56f0088d" or
        hash.md5(0, filesize) == "e33f942cf1479ca8530a916868bad954" or
        hash.md5(0, filesize) == "e8680d17fba6425e4a9bb552fb8db2b1" or
        hash.md5(0, filesize) == "e9fdd703e60b31eb803b1b59985cabec" or
        hash.md5(0, filesize) == "eda0525c078f5a216a977bc64e86160a" or
        hash.md5(0, filesize) == "f1bad0efbd3bd5a4202fe740756f977a" or
        hash.md5(0, filesize) == "f1d2af27b13cd3424556b18dfd3cf83f" or
        hash.md5(0, filesize) == "f8bb2528bf35f8c11fbc4369e68c4038" or
        hash.sha256(0, filesize) == "3dd226d0b700f33974f409142defb62a8cd172ae5f2eb9beb7f5750eb1702e2a" or
        hash.sha256(0, filesize) == "4451ee8bc53ea7c148d8348bc7b82aca9977bdd31c0156dfe25c4a879a1d2190" or
        hash.sha256(0, filesize) == "5b77f83ecefa0e32ba922f61c9efff7f755ba51a010db844ca7e8ad3db28650a" or
        hash.sha256(0, filesize) == "71b743c529f0b27735f7774a0903cb908edc93423b60fe9be49a3729982d0e8d" or
        hash.sha256(0, filesize) == "a6c1a7ce43b029a1ef4ae69b26f745440ecce8368c89f11ac999d4ed04a31572" or
        hash.sha256(0, filesize) == "b3cc15c1033de79024f9cf3cd6a6a7a9b7e54a1a57d3156036f5c05f541694b7" or
        hash.sha256(0, filesize) == "b494a0ae421afe170f6cb9de2c1193a78fbe16f627f85139676afc5d9bfe93a2" or
        hash.sha256(0, filesize) == "c4db903322d17c8cbf1d1db55124854c0b070d6ece54162b6a4d06df24c572df"
}