import "hash"

rule bulwark_https_bulwarkblack_com_deno_runtime_abuse_developer_tooling_security_governance
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/deno-runtime-abuse-developer-tooling-security-governance/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-11T15:11:31Z"
        tlp = "TLP:CLEAR"
        indicator_count = "18"
    strings:
        $s0 = "crahdhduf.com" ascii wide nocase  // Domains
        $s1 = "koromoblog.com" ascii wide nocase  // Domains
        $s2 = "readme-ov-filegithub.com" ascii wide nocase  // Domains
        $s3 = "sendtokenscf.com" ascii wide nocase  // Domains
        $s4 = "serialmenot.com" ascii wide nocase  // Domains
        $s5 = "www.bing.com" ascii wide nocase  // Domains
        $s6 = "ypjkevsbsdhj.zhivachkapro.com" ascii wide nocase  // Domains
        $s7 = "zhivachkapro.com" ascii wide nocase  // Domains
        $s8 = "bing.com/search?pglt=2083&amp" ascii wide nocase  // URLs
        $s9 = "http://koromoblog.com/u" ascii wide nocase  // URLs
        $s10 = "https://ypjkevsbsdhj.zhivachkapro.com/pobor).Content" ascii wide nocase  // URLs
        $s11 = "koromoblog.com/u" ascii wide nocase  // URLs
        $s12 = "ypjkevsbsdhj.zhivachkapro.com/pobor" ascii wide nocase  // URLs
        $s13 = "144.31.2.161" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "26b2cafb71b1407b8e01649548cf56aa" or
        hash.sha256(0, filesize) == "2541d96d1d071f87127bf0714f70692d25e1946632457718c6f378fcc4a3dca2" or
        hash.sha256(0, filesize) == "74260ef8c440692043aaa4656947258b3acfc207c95f09682b69d031b42890a0" or
        hash.sha256(0, filesize) == "b0af82de672d81f3c2f153977923b3884a8a9e7045b182c2379b19a1996931a0"
}