import "hash"

rule bulwark_https_bulwarkblack_com_systembc_botnet_survives_law_enforcement_takedown_infects_over_10
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/systembc-botnet-survives-law-enforcement-takedown-infects-over-10000-devices-worldwide/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:32Z"
        tlp = "TLP:CLEAR"
        indicator_count = "27"
    strings:
        $s0 = "bthoster.com" ascii wide nocase  // Domains
        $s1 = "concours.gov" ascii wide nocase  // Domains
        $s2 = "concours.gov.bf" ascii wide nocase  // Domains
        $s3 = "exploit.in" ascii wide nocase  // Domains
        $s4 = "forum.exploit.in" ascii wide nocase  // Domains
        $s5 = "gov.vn" ascii wide nocase  // Domains
        $s6 = "phutho.duchop.gov.vn" ascii wide nocase  // Domains
        $s7 = "duchop.gov.vn" ascii wide nocase  // URLs
        $s8 = "103.112.211.167" ascii wide nocase  // IPv4
        $s9 = "103.28.36.105" ascii wide nocase  // IPv4
        $s10 = "148.113.208.227" ascii wide nocase  // IPv4
        $s11 = "185.93.89.145" ascii wide nocase  // IPv4
        $s12 = "196.13.207.92" ascii wide nocase  // IPv4
        $s13 = "202.142.184.234" ascii wide nocase  // IPv4
        $s14 = "36.255.98.152" ascii wide nocase  // IPv4
        $s15 = "36.255.98.159" ascii wide nocase  // IPv4
        $s16 = "36.255.98.160" ascii wide nocase  // IPv4
        $s17 = "36.255.98.165" ascii wide nocase  // IPv4
        $s18 = "36.255.98.179" ascii wide nocase  // IPv4
        $s19 = "62.60.131.180" ascii wide nocase  // IPv4
        $s20 = "62.60.131.184" ascii wide nocase  // IPv4
        $s21 = "62.60.131.187" ascii wide nocase  // IPv4
        $s22 = "62.60.131.191" ascii wide nocase  // IPv4
        $s23 = "62.60.131.204" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0f5c81eaf35755a52e670c89b9546e7047828d83f346e3c29be1f6958e14a384" or
        hash.sha256(0, filesize) == "c729bf6ea292116b3477da4843aaeec73370e2bd46e7a27674671e9a65fb473a" or
        hash.sha256(0, filesize) == "da95384032f84228ef62f982f3c0f9e574dc6b06b606db33889ea6a5f93d6ae2"
}