import "hash"

rule bulwark_https_bulwarkblack_com_jadeprox_triback_loader_china_nexus_exposure_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/jadeprox-triback-loader-china-nexus-exposure-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-23T15:04:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "55"
    strings:
        $s0 = "claude-pro.com" ascii wide nocase  // Domains
        $s1 = "dlrz-web.oss-cn-beijing.aliyuncs.com" ascii wide nocase  // Domains
        $s2 = "edu.hk" ascii wide nocase  // Domains
        $s3 = "gouvvbo.top" ascii wide nocase  // Domains
        $s4 = "license.claude-pro.com" ascii wide nocase  // Domains
        $s5 = "photo.pokok.edu.hk" ascii wide nocase  // Domains
        $s6 = "pta.sfaeps.edu.hk" ascii wide nocase  // Domains
        $s7 = "sylverixstrategy.com" ascii wide nocase  // Domains
        $s8 = "update-crowdstrike.com" ascii wide nocase  // Domains
        $s9 = "update-sentinelone.com" ascii wide nocase  // Domains
        $s10 = "update-trellix.com" ascii wide nocase  // Domains
        $s11 = "vertextrust-advisors.com" ascii wide nocase  // Domains
        $s12 = "aliyuncs.com" ascii wide nocase  // URLs
        $s13 = "pokok.edu.hk" ascii wide nocase  // URLs
        $s14 = "sfaeps.edu.hk" ascii wide nocase  // URLs
        $s15 = "104.21.60.96" ascii wide nocase  // IPv4
        $s16 = "140.0.0.0" ascii wide nocase  // IPv4
        $s17 = "161.35.236.255" ascii wide nocase  // IPv4
        $s18 = "178.128.108.89" ascii wide nocase  // IPv4
        $s19 = "192.252.186.62" ascii wide nocase  // IPv4
        $s20 = "43.106.71.28" ascii wide nocase  // IPv4
        $s21 = "8.217.190.58" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "0482d6053f96e6bde0a92af25497f3c0" or
        hash.md5(0, filesize) == "0e6d22c2a81d29b1f9d8395d44e19e53" or
        hash.md5(0, filesize) == "35cdbf8a16da1245d574a0365cb87287" or
        hash.md5(0, filesize) == "38e317af0fc0efcc88265f243a264542" or
        hash.md5(0, filesize) == "39d4012e49f58092ec5cefed13dbbcfd" or
        hash.md5(0, filesize) == "3b3dd8f3a5e1ff85c63f2453ad270415" or
        hash.md5(0, filesize) == "3fe9c84025f4401f8cd661675642c526" or
        hash.md5(0, filesize) == "4faf4fd91d28e014b4f2362d6a7bb8ac" or
        hash.md5(0, filesize) == "5222a31cf24f9f57ae3d1831f264a983" or
        hash.md5(0, filesize) == "5b75b00a4b4c32b6e213514e80500a65" or
        hash.md5(0, filesize) == "7840f30b395fac347f85b38633c2d08d" or
        hash.md5(0, filesize) == "796f82a4833be330b1e35af63e55b597" or
        hash.md5(0, filesize) == "7c84e75817349adcdea9925b86f67670" or
        hash.md5(0, filesize) == "8002ab4d0cf7e1888ee72de0b9f4282c" or
        hash.md5(0, filesize) == "853f760f76de3201b0af0e41f1f65fba" or
        hash.md5(0, filesize) == "88ac1c5fc9ee89491c70ea16131e264a" or
        hash.md5(0, filesize) == "9e01bf0e28c86435cfb1afaef44238e9" or
        hash.md5(0, filesize) == "a4cdecc57a215243d279cdb065863308" or
        hash.md5(0, filesize) == "aedd185b76ccda8d65dbd26204cc0e9a" or
        hash.md5(0, filesize) == "b8053bcd04ce9d7d19c7f36830a9f26b" or
        hash.md5(0, filesize) == "bb5c88de9e04e6306260b9f3a4498933" or
        hash.md5(0, filesize) == "bef0b8599d18acf1c74192ae9f198f85" or
        hash.md5(0, filesize) == "c1f45a0609c5c1bd2c21cad20703f126" or
        hash.md5(0, filesize) == "c512adfa8743c3b3c776d4452f00c6c0" or
        hash.md5(0, filesize) == "c64eda499e2a21ad158841b9dbc7adc9" or
        hash.md5(0, filesize) == "d99392248bdd7e351e63ead6733638ba" or
        hash.md5(0, filesize) == "df1f03a2534480a4838f62339bcb90d8" or
        hash.md5(0, filesize) == "e067ffea77875ae0dc13d4ce045931d3" or
        hash.md5(0, filesize) == "ee5a2cdd4ce6ccb2e9279c9e13e8bd15" or
        hash.md5(0, filesize) == "efac43473d7e87ede5176fe01a114abb" or
        hash.md5(0, filesize) == "f2ce6fe8b52dfbacfee482a48f4ae972" or
        hash.md5(0, filesize) == "f360afe51b499a036c7be8c0ecc4dc89" or
        hash.md5(0, filesize) == "fef1d3cb35129ad25d95e279565b9001"
}