import "hash"

rule bulwark_https_bulwarkblack_com_fake_7_zip_downloads_convert_home_pcs_into_residential_proxy_node
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fake-7-zip-downloads-convert-home-pcs-into-residential-proxy-nodes-for-cybercriminals/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:14Z"
        tlp = "TLP:CLEAR"
        indicator_count = "19"
    strings:
        $s0 = "7-zip.org" ascii wide nocase  // Domains
        $s1 = "7zip.com" ascii wide nocase  // Domains
        $s2 = "apex.herosms.ai" ascii wide nocase  // Domains
        $s3 = "flux.smshero.co" ascii wide nocase  // Domains
        $s4 = "iplogger.org" ascii wide nocase  // Domains
        $s5 = "neo.herosms.co" ascii wide nocase  // Domains
        $s6 = "nova.smshero.ai" ascii wide nocase  // Domains
        $s7 = "soc.hero-sms.co" ascii wide nocase  // Domains
        $s8 = "spark.herosms.io" ascii wide nocase  // Domains
        $s9 = "hero-sms.co" ascii wide nocase  // URLs
        $s10 = "herosms.ai" ascii wide nocase  // URLs
        $s11 = "herosms.co" ascii wide nocase  // URLs
        $s12 = "herosms.io" ascii wide nocase  // URLs
        $s13 = "smshero.ai" ascii wide nocase  // URLs
        $s14 = "smshero.co" ascii wide nocase  // URLs
        $s15 = "Mutex: Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7" ascii wide nocase  // Mutex Names
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9" or
        hash.sha256(0, filesize) == "b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894" or
        hash.sha256(0, filesize) == "e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027"
}