import "hash"

rule bulwark_https_bulwarkblack_com_sonicwall_sma_inc_ransomware_exploit_chain_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/sonicwall-sma-inc-ransomware-exploit-chain-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-01T20:03:51Z"
        tlp = "TLP:CLEAR"
        indicator_count = "39"
    strings:
        $s0 = "icann.org" ascii wide nocase  // Domains
        $s1 = "whois.ordertld.com" ascii wide nocase  // Domains
        $s2 = "www.ordertld.com" ascii wide nocase  // Domains
        $s3 = "HELPRANS.COM" ascii wide nocase  // URLs
        $s4 = "helprans.com" ascii wide nocase  // URLs
        $s5 = "http://www.ordertld.com" ascii wide nocase  // URLs
        $s6 = "https://icann.org/epp#clientTransferProhibited" ascii wide nocase  // URLs
        $s7 = "108.205.8.173" ascii wide nocase  // IPv4
        $s8 = "147.45.51.19" ascii wide nocase  // IPv4
        $s9 = "149.0.0.1" ascii wide nocase  // IPv4
        $s10 = "150.241.210.53" ascii wide nocase  // IPv4
        $s11 = "173.239.211.0" ascii wide nocase  // IPv4
        $s12 = "193.37.32.179" ascii wide nocase  // IPv4
        $s13 = "193.37.32.214" ascii wide nocase  // IPv4
        $s14 = "202.8.105.201" ascii wide nocase  // IPv4
        $s15 = "216.73.163.151" ascii wide nocase  // IPv4
        $s16 = "216.73.163.158" ascii wide nocase  // IPv4
        $s17 = "217.77.15.99" ascii wide nocase  // IPv4
        $s18 = "42.200.172.14" ascii wide nocase  // IPv4
        $s19 = "45.131.194.0" ascii wide nocase  // IPv4
        $s20 = "45.146.54.0" ascii wide nocase  // IPv4
        $s21 = "63.135.161.0" ascii wide nocase  // IPv4
        $s22 = "81.19.140.217" ascii wide nocase  // IPv4
        $s23 = "89.117.20.1" ascii wide nocase  // IPv4
        $s24 = "abuse@ordertld.com" ascii wide nocase  // Email Addresses
        $s25 = "contact@resecurity.com" ascii wide nocase  // Email Addresses
        $s26 = "info@helprans.com" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "54d21399b8b52b48a0fef68450593e45" or
        hash.md5(0, filesize) == "5cb00bbfe818ee3e85fb99ab1db1af7c" or
        hash.md5(0, filesize) == "5f3a55201c511c9ff9be4c16c41028a2" or
        hash.md5(0, filesize) == "b6df166291f80ee89032d769c99714f3" or
        hash.sha1(0, filesize) == "04d4a9fbb32e967200eb98be014ca914a03bfa6b" or
        hash.sha1(0, filesize) == "5e5b716f2385c818ec61198be1a2a07a4560eac5" or
        hash.sha1(0, filesize) == "b4ee1f50fbb49f0ff5fde3d026343bc23ee08d51" or
        hash.sha1(0, filesize) == "c2b0ae0a1f42a139abe4dd612676066ec1426394" or
        hash.sha256(0, filesize) == "1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee" or
        hash.sha256(0, filesize) == "81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2" or
        hash.sha256(0, filesize) == "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3" or
        hash.sha256(0, filesize) == "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081"
}