import "hash"

rule bulwark_https_bulwarkblack_com_financially_motivated_threat_actors_misusing_app_installer
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/financially-motivated-threat-actors-misusing-app-installer/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:18Z"
        tlp = "TLP:CLEAR"
        indicator_count = "56"
    strings:
        $s0 = "1204knos.ru" ascii wide nocase  // Domains
        $s1 = "1204networks.ru" ascii wide nocase  // Domains
        $s2 = "abobe.ithr.org" ascii wide nocase  // Domains
        $s3 = "aka.ms" ascii wide nocase  // Domains
        $s4 = "amgreetings.tech" ascii wide nocase  // Domains
        $s5 = "amgreetings.tech-department.us" ascii wide nocase  // Domains
        $s6 = "amydeks.ithr.org" ascii wide nocase  // Domains
        $s7 = "api.store" ascii wide nocase  // Domains
        $s8 = "cabotcorpsupport-my.sharepoint.com" ascii wide nocase  // Domains
        $s9 = "cbre.tech" ascii wide nocase  // Domains
        $s10 = "cbre.tech-department.us" ascii wide nocase  // Domains
        $s11 = "formeld.tech" ascii wide nocase  // Domains
        $s12 = "formeld.tech-department.us" ascii wide nocase  // Domains
        $s13 = "gertefin.com" ascii wide nocase  // Domains
        $s14 = "hubergroup.tech" ascii wide nocase  // Domains
        $s15 = "hubergroup.tech-department.us" ascii wide nocase  // Domains
        $s16 = "info-zoomapp.com" ascii wide nocase  // Domains
        $s17 = "kellyhrservices-my.sharepoint.com" ascii wide nocase  // Domains
        $s18 = "kellyservices-hr.com" ascii wide nocase  // Domains
        $s19 = "kellyservicesheadhunter-my.sharepoint.com" ascii wide nocase  // Domains
        $s20 = "kellyserviceshr-my.sharepoint.com" ascii wide nocase  // Domains
        $s21 = "kellyservicesrecruitmentdep-my.sharepoint.com" ascii wide nocase  // Domains
        $s22 = "mckinseyhrcompany-my.sharepoint.com" ascii wide nocase  // Domains
        $s23 = "meetlng.group" ascii wide nocase  // Domains
        $s24 = "nixonpeabody.tech" ascii wide nocase  // Domains
        $s25 = "nixonpeabody.tech-department.us" ascii wide nocase  // Domains
        $s26 = "perimeter81support-my.sharepoint.com" ascii wide nocase  // Domains
        $s27 = "scheta.site" ascii wide nocase  // Domains
        $s28 = "septcntr.com" ascii wide nocase  // Domains
        $s29 = "sharepoint.com" ascii wide nocase  // Domains
        $s30 = "storageplace.pro" ascii wide nocase  // Domains
        $s31 = "sun1.space" ascii wide nocase  // Domains
        $s32 = "tab1eu.ithr.org" ascii wide nocase  // Domains
        $s33 = "teannviewer.ithr.org" ascii wide nocase  // Domains
        $s34 = "tech-department.us" ascii wide nocase  // Domains
        $s35 = "thecyberwire.com" ascii wide nocase  // Domains
        $s36 = "tnetworkslicense.ru" ascii wide nocase  // Domains
        $s37 = "webmicrosoftservicesystem.com" ascii wide nocase  // Domains
        $s38 = "zoonn.ithr.org" ascii wide nocase  // Domains
        $s39 = "zoonn.meetlng.group" ascii wide nocase  // Domains
        $s40 = "https://aka.ms/threatintelblog" ascii wide nocase  // URLs
        $s41 = "https://scheta.site/api.store/Setup.msix" ascii wide nocase  // URLs
        $s42 = "https://scheta.site/api.store/ZoomInstaller.msix" ascii wide nocase  // URLs
        $s43 = "https://thecyberwire.com/podcasts/microsoft-threat-intelligence" ascii wide nocase  // URLs
        $s44 = "ithr.org" ascii wide nocase  // URLs
        $s45 = "scheta.site/api.store/Setup.msix" ascii wide nocase  // URLs
        $s46 = "scheta.site/api.store/ZoomInstaller.msix" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "06b4aebbc3cd62e0aadd1852102645f9a00cc7eea492c0939675efba7566a6de" or
        hash.sha256(0, filesize) == "11b71429869f29122236a44a292fde3f0269cde8eb76a52c89139f79f4b97e63" or
        hash.sha256(0, filesize) == "2ba527fb8e31cb209df8d1890a63cda9cd4433aa0b841ed8b86fa801aff4ccbd" or
        hash.sha256(0, filesize) == "2ed5660c7b768b4c2a7899d00773af60cd4396f24a2f7d643ccc1bf74a403970" or
        hash.sha256(0, filesize) == "44cac5bf0bab56b0840bd1c7b95f9c7f5078ff417705eeaaf5ea5a2167a81dd5" or
        hash.sha256(0, filesize) == "48aa2393ef590bab4ff2fd1e7d95af36e5b6911348d7674347626c9aaafa255e" or
        hash.sha256(0, filesize) == "7e646dfe7b7f330cb21db07b94f611eb39f604fab36e347fb884f797ba462402" or
        hash.sha256(0, filesize) == "b79633917e51da2a4401473d08719f493d61fd64a1b10fe482c12d984d791ccb" or
        hash.sha256(0, filesize) == "ffb45dc14ea908b21e01e87ec18725dff560c093884005c2b71277e2de354866"
}