import "hash"

rule bulwark_https_bulwarkblack_com_evooo1bot_linux_botnet_edge_device_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/evooo1bot-linux-botnet-edge-device-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-13T20:04:54Z"
        tlp = "TLP:CLEAR"
        indicator_count = "3"
    strings:
        $s0 = "91.92.40.118" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d" or
        hash.sha256(0, filesize) == "f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109"
}