import "hash"

rule bulwark_https_bulwarkblack_com_iranian_mois_cyber_actors_embrace_criminal_ecosystem_from_rhadama
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/iranian-mois-cyber-actors-embrace-criminal-ecosystem-from-rhadamanthys-to-ransomware-affiliates/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:32:10Z"
        tlp = "TLP:CLEAR"
        indicator_count = "26"
    strings:
        $s0 = "18.223.24.218" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "eb5e96e05129e5691f9677be4e396c88" or
        hash.sha1(0, filesize) == "0902d7915a19975817ec1ccb0f2f6714aed19638" or
        hash.sha1(0, filesize) == "2087bb914327e937ea6e77fe6c832576338c2af8" or
        hash.sha1(0, filesize) == "21a435ecaa7b86efbec7f6fb61fcda3da686125c" or
        hash.sha1(0, filesize) == "389b12da259a23fa4559eb1d97198120f2a722fe" or
        hash.sha1(0, filesize) == "551bdf646df8e9abe04483882650a8ffae43cb55" or
        hash.sha1(0, filesize) == "579a4584a6eef0a2453841453221d0fb25c08c89" or
        hash.sha1(0, filesize) == "9dcb994ea2b8e6169b76a524fae7b2d2dcd1807d" or
        hash.sha1(0, filesize) == "b674578d4bdb24cd58bf2dc884eaa658b7aa250c" or
        hash.sha1(0, filesize) == "d920ae0f8ea8b5bd42de49e01c6bbd4c2c6d0847" or
        hash.sha1(0, filesize) == "f8444dfc740b94227ab9b2e757b8f8f1fa49362a" or
        hash.sha256(0, filesize) == "077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de" or
        hash.sha256(0, filesize) == "24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14" or
        hash.sha256(0, filesize) == "2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5" or
        hash.sha256(0, filesize) == "2b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e6" or
        hash.sha256(0, filesize) == "4aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be" or
        hash.sha256(0, filesize) == "64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb" or
        hash.sha256(0, filesize) == "64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f1" or
        hash.sha256(0, filesize) == "74db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d" or
        hash.sha256(0, filesize) == "94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444" or
        hash.sha256(0, filesize) == "a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377" or
        hash.sha256(0, filesize) == "a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72b" or
        hash.sha256(0, filesize) == "a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0" or
        hash.sha256(0, filesize) == "aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f" or
        hash.sha256(0, filesize) == "ddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888"
}