import "hash"

rule bulwark_https_bulwarkblack_com_cisco_sdwan_active_exploitation_edge_controller_review
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/cisco-sdwan-active-exploitation-edge-controller-review/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:41Z"
        tlp = "TLP:CLEAR"
        indicator_count = "37"
    strings:
        $s0 = "1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev" ascii wide nocase  // Domains
        $s1 = "a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev" ascii wide nocase  // Domains
        $s2 = "replit.dev" ascii wide nocase  // Domains
        $s3 = "http://13.62.52.206:5004&nbsp" ascii wide nocase  // URLs
        $s4 = "http://13.62.52.206:5004”" ascii wide nocase  // URLs
        $s5 = "http://83.229.126.195:8081/config.json" ascii wide nocase  // URLs
        $s6 = "http://83.229.126.195:8081/xmrig" ascii wide nocase  // URLs
        $s7 = "https://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev/download" ascii wide nocase  // URLs
        $s8 = "104.233.156.1" ascii wide nocase  // IPv4
        $s9 = "13.62.52.206" ascii wide nocase  // IPv4
        $s10 = "176.65.139.31" ascii wide nocase  // IPv4
        $s11 = "194.163.175.135" ascii wide nocase  // IPv4
        $s12 = "194.233.100.40" ascii wide nocase  // IPv4
        $s13 = "212.83.162.37" ascii wide nocase  // IPv4
        $s14 = "23.27.143.170" ascii wide nocase  // IPv4
        $s15 = "38.181.52.89" ascii wide nocase  // IPv4
        $s16 = "38.60.214.92" ascii wide nocase  // IPv4
        $s17 = "47.104.248.7" ascii wide nocase  // IPv4
        $s18 = "65.20.67.134" ascii wide nocase  // IPv4
        $s19 = "71.80.85.135" ascii wide nocase  // IPv4
        $s20 = "79.135.105.208" ascii wide nocase  // IPv4
        $s21 = "83.229.126.195" ascii wide nocase  // IPv4
        $s22 = "89.125.244.33" ascii wide nocase  // IPv4
        $s23 = "89.125.244.51" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "fece5b954e69b2c6a8d0a1029631a0d7" or
        hash.sha256(0, filesize) == "02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8" or
        hash.sha256(0, filesize) == "0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d" or
        hash.sha256(0, filesize) == "0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0" or
        hash.sha256(0, filesize) == "17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925" or
        hash.sha256(0, filesize) == "18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80" or
        hash.sha256(0, filesize) == "5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8" or
        hash.sha256(0, filesize) == "72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060" or
        hash.sha256(0, filesize) == "7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1" or
        hash.sha256(0, filesize) == "96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46" or
        hash.sha256(0, filesize) == "b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3" or
        hash.sha256(0, filesize) == "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa" or
        hash.sha256(0, filesize) == "f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1"
}