import "hash"

rule bulwark_https_bulwarkblack_com_boryptgrab_stealer_spreads_through_100_fake_github_repositories_i
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/boryptgrab-stealer-spreads-through-100-fake-github-repositories-in-massive-malware-campaign/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:33Z"
        tlp = "TLP:CLEAR"
        indicator_count = "34"
    strings:
        $s0 = "best-tinted.com" ascii wide nocase  // Domains
        $s1 = "botshield.vu" ascii wide nocase  // Domains
        $s2 = "claude.ai" ascii wide nocase  // Domains
        $s3 = "kiamatka.com" ascii wide nocase  // Domains
        $s4 = "best-tinted.com/github-download.html" ascii wide nocase  // URLs
        $s5 = "botshield.vu/KKRkm9" ascii wide nocase  // URLs
        $s6 = "botshield.vu/kFcjld" ascii wide nocase  // URLs
        $s7 = "http://193.143.1.104:5000" ascii wide nocase  // URLs
        $s8 = "http://45.93.20.195:5000" ascii wide nocase  // URLs
        $s9 = "http://45.93.20.61:5466/api/x32_chromium" ascii wide nocase  // URLs
        $s10 = "https://best-tinted.com/github-download.html" ascii wide nocase  // URLs
        $s11 = "https://botshield.vu/KKRkm9" ascii wide nocase  // URLs
        $s12 = "https://botshield.vu/kFcjld" ascii wide nocase  // URLs
        $s13 = "https://kiamatka.com/kaiok.kakman" ascii wide nocase  // URLs
        $s14 = "kiamatka.com/kaiok.kakman" ascii wide nocase  // URLs
        $s15 = "193.143.1.104" ascii wide nocase  // IPv4
        $s16 = "45.93.20.195" ascii wide nocase  // IPv4
        $s17 = "45.93.20.61" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a50642181" or
        hash.sha256(0, filesize) == "15de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd5" or
        hash.sha256(0, filesize) == "1bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d76" or
        hash.sha256(0, filesize) == "2050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a" or
        hash.sha256(0, filesize) == "2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f955518" or
        hash.sha256(0, filesize) == "4264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd" or
        hash.sha256(0, filesize) == "433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476" or
        hash.sha256(0, filesize) == "449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf225" or
        hash.sha256(0, filesize) == "4e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997" or
        hash.sha256(0, filesize) == "576692df4bf1c7d8927d3a183f5219a81c3bff3dd22971691f8af6889f80c5a0" or
        hash.sha256(0, filesize) == "7f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166c" or
        hash.sha256(0, filesize) == "c40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707" or
        hash.sha256(0, filesize) == "d295720bc0c1111ce1c3d8b1bc1b36ba840f103b3ca7e95a5a8bf03e2cc44fe5" or
        hash.sha256(0, filesize) == "ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640" or
        hash.sha256(0, filesize) == "fa767391b99865f8533efc1fe6dfa6175215718679fb00ca85fc13c3bd4ae4b7" or
        hash.sha256(0, filesize) == "fe4e5fb28d2c2b3a640112b6b125ce8c4afa8be28342e3bfda097ad9dd2ef9ee"
}