import "hash"

rule bulwark_https_bulwarkblack_com_gentlemen_raas_leak_edge_device_ransomware_risk
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/gentlemen-raas-leak-edge-device-ransomware-risk/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:29Z"
        tlp = "TLP:CLEAR"
        indicator_count = "64"
    strings:
        $s0 = "chamd5.org" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "03860d116701cdc9d9bf9c45099bb3d3" or
        hash.md5(0, filesize) == "11e7baca7e652995b2364fdab0d362b7" or
        hash.md5(0, filesize) == "2cd4eb358c45ca783a20ec854a5a860c" or
        hash.md5(0, filesize) == "2e5d1a352885a6efd84dbc0387cbc79e" or
        hash.md5(0, filesize) == "3b7b4f2d33bdfb8a31b480d0eb2815cd" or
        hash.md5(0, filesize) == "4a94d2b730a5a63e6cd54a9b0bb4ea71" or
        hash.md5(0, filesize) == "4e0c37cbf4dde9683943c8a738e5b00a" or
        hash.md5(0, filesize) == "51dec3e170f8a181cc9aea8dcc90c7ab" or
        hash.md5(0, filesize) == "583fe1c1a39f6b873a5c0997bea1f657" or
        hash.md5(0, filesize) == "697f182826495662427ca49edbb345fc" or
        hash.md5(0, filesize) == "71d503709af88821c183a1d0b7ae06ec" or
        hash.md5(0, filesize) == "721606b3659f2c2d80a196ed3cd60053" or
        hash.md5(0, filesize) == "735069890a414869f0113de820ba9afb" or
        hash.md5(0, filesize) == "74ea100b581ec32ea6c2ac2a0030a9f6" or
        hash.md5(0, filesize) == "776e86c13433747299a4e5f9f22e3415" or
        hash.md5(0, filesize) == "7aae8fd9187c88dd0292cce1abd050e2" or
        hash.md5(0, filesize) == "81a578e065da1ccd8c81a8e90c309275" or
        hash.md5(0, filesize) == "82160a7da5fc4c935e6f48d38a5aaaa6" or
        hash.md5(0, filesize) == "893f735e9a8cc9814dc6eccd5579561c" or
        hash.md5(0, filesize) == "8fceea4fd9ce32dd620ccd580297c7c5" or
        hash.md5(0, filesize) == "92d8bd2a6ee7f6d5c84e037066ce0539" or
        hash.md5(0, filesize) == "a023a6b15419600dc3f6b93e11761dfe" or
        hash.md5(0, filesize) == "a73526d89e5fb7b57f50d8da340e53e9" or
        hash.md5(0, filesize) == "abd11823ddcc3d746ad8621e677a93eb" or
        hash.md5(0, filesize) == "b5b42ac289581b3387ebf120129a19a6" or
        hash.md5(0, filesize) == "b68e019efb39b85f5a0326e22fd4498a" or
        hash.md5(0, filesize) == "bc6b87c79bc71a78da623d031ec1a958" or
        hash.md5(0, filesize) == "d75246d230f22b1da6bbf5fceeed2ef2" or
        hash.md5(0, filesize) == "da9cff1b478b64d47b68d50330e96c60" or
        hash.md5(0, filesize) == "ead0d7a8ae0a6ffb7f0a5873fec4ff5e" or
        hash.sha256(0, filesize) == "025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a" or
        hash.sha256(0, filesize) == "1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f" or
        hash.sha256(0, filesize) == "1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b2" or
        hash.sha256(0, filesize) == "1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c" or
        hash.sha256(0, filesize) == "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67" or
        hash.sha256(0, filesize) == "24ac3588fb8cfbff63b7fdfcbc7dec1f3c60e54e6f949dd69d68e89e0c89d966" or
        hash.sha256(0, filesize) == "2ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d" or
        hash.sha256(0, filesize) == "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235" or
        hash.sha256(0, filesize) == "3c2182cb0bc7528829ef03f1b1745a92bcc47d917eb8870862488f21fdf1a6d6" or
        hash.sha256(0, filesize) == "48d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd" or
        hash.sha256(0, filesize) == "4a175eed927c0a477eafb8aa35a93c191748acaa78ac7aecd8ea3c4cd868887c" or
        hash.sha256(0, filesize) == "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2" or
        hash.sha256(0, filesize) == "5dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca" or
        hash.sha256(0, filesize) == "62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb8" or
        hash.sha256(0, filesize) == "6a3ab9e984a759d55af4e84487d1fc44683065cc9a1089d5aa4ad1c0e4e84a63" or
        hash.sha256(0, filesize) == "788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19" or
        hash.sha256(0, filesize) == "860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba431158923" or
        hash.sha256(0, filesize) == "87d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c" or
        hash.sha256(0, filesize) == "8aa0cb69ca2777001e0f4ba0eaab0841592710e4cc5ccd6b0b526d78bbd8bfba" or
        hash.sha256(0, filesize) == "8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db" or
        hash.sha256(0, filesize) == "91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1" or
        hash.sha256(0, filesize) == "994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e3" or
        hash.sha256(0, filesize) == "9f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454" or
        hash.sha256(0, filesize) == "a7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0ad" or
        hash.sha256(0, filesize) == "b67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6" or
        hash.sha256(0, filesize) == "c46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8" or
        hash.sha256(0, filesize) == "c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73" or
        hash.sha256(0, filesize) == "dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70" or
        hash.sha256(0, filesize) == "dfe696ff713318c53fb17731bd4a6585a02c085b590149b19847990b324a0be6" or
        hash.sha256(0, filesize) == "ec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2" or
        hash.sha256(0, filesize) == "efaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108f" or
        hash.sha256(0, filesize) == "f736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12" or
        hash.sha256(0, filesize) == "fc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958"
}