import "hash"

rule bulwark_https_bulwarkblack_com_p2pinfect_kubernetes_redis_botnet_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/p2pinfect-kubernetes-redis-botnet-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:56:36Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "http://8.210.50.65:60126/linux" ascii wide nocase  // URLs
        $s1 = "178.62.63.125" ascii wide nocase  // IPv4
        $s2 = "47.237.140.12" ascii wide nocase  // IPv4
        $s3 = "47.83.124.121" ascii wide nocase  // IPv4
        $s4 = "47.86.33.195" ascii wide nocase  // IPv4
        $s5 = "47.86.5.176" ascii wide nocase  // IPv4
        $s6 = "8.210.178.40" ascii wide nocase  // IPv4
        $s7 = "8.210.50.65" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "08ad2c2877edda9a050b81d011c1c003" or
        hash.md5(0, filesize) == "5d1ca537c4bedebf2f4d276d4199ea95" or
        hash.md5(0, filesize) == "80676a539765a9e117f20b6b99887eca" or
        hash.md5(0, filesize) == "a1a35afebb585917675534de3d610c93"
}