import "hash"

rule bulwark_https_bulwarkblack_com_tag150_clickfix_denorat_runtime_abuse_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/tag150-clickfix-denorat-runtime-abuse-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-26T15:10:39Z"
        tlp = "TLP:CLEAR"
        indicator_count = "28"
    strings:
        $s0 = "Obfuscator.io" ascii wide nocase  // Domains
        $s1 = "cktdpnuwztdn.columbnezhjdq.com" ascii wide nocase  // Domains
        $s2 = "columbnezhjdq.com" ascii wide nocase  // Domains
        $s3 = "smallsmokik.com" ascii wide nocase  // Domains
        $s4 = "webstizkgao.com" ascii wide nocase  // Domains
        $s5 = "www.esentire.com" ascii wide nocase  // Domains
        $s6 = "http://webstizkgao.com" ascii wide nocase  // URLs
        $s7 = "http://webstizkgao.com/health" ascii wide nocase  // URLs
        $s8 = "http://webstizkgao.com/message-event" ascii wide nocase  // URLs
        $s9 = "http://webstizkgao.com/user" ascii wide nocase  // URLs
        $s10 = "https://cktdpnuwztdn.columbnezhjdq.com" ascii wide nocase  // URLs
        $s11 = "https://www.esentire.com/blog/new-botnet-emerges-from-the-shadows-nightshadec2" ascii wide nocase  // URLs
        $s12 = "webstizkgao.com/health" ascii wide nocase  // URLs
        $s13 = "webstizkgao.com/message-event" ascii wide nocase  // URLs
        $s14 = "webstizkgao.com/user" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "1f233db3e59051811e16c65e32121f69dd80e91567002978e47a613a5a4903b0" or
        hash.sha256(0, filesize) == "2e9812a0dc5998a3f9a59fe64193884a67dadac05171494ffd2b81a711eb1359" or
        hash.sha256(0, filesize) == "3dffe05d9cc49b2598d743301a8991965056d97bb8d429de461ed66c0dbde28b" or
        hash.sha256(0, filesize) == "4ac3e1ecd2c4745f2e846ec7655b92234ee92068bffc7690c3f0184dc25c71da" or
        hash.sha256(0, filesize) == "6103228087aaee53f37db88ab7aa1e7e5dd8c27a395bef7e3af985774a888c94" or
        hash.sha256(0, filesize) == "7682e9ac86ff47cc198812719ca54e169c3cb21ce584ad2a278a640f4833de46" or
        hash.sha256(0, filesize) == "a06d514a34d2ab08c3a13a58056827c50ba9bf01b68ca4b2cecb4e1462af53fa" or
        hash.sha256(0, filesize) == "b4fd836b82f2d8daf8b90a95046987e993e5687707fc57b527a8145d865e3fdc" or
        hash.sha256(0, filesize) == "c1e0a0543b12c64726f8bb36389010d7f35e57993a22ce5b73c56b9cc2a87a00" or
        hash.sha256(0, filesize) == "c2cdf1ecd6684bbcef0405444a570a76e9589bbd563476b08788bde34d83b511" or
        hash.sha256(0, filesize) == "e0dd60bb3a409029988db6a10cb1e36586c2636da9eff3a3587bc38473fde54b" or
        hash.sha256(0, filesize) == "ece42baaca7524460cc5ffc9ae94c2a634a67610decdd2bdc8f134c36fa2dd6c" or
        hash.sha256(0, filesize) == "fa0d1adb545881a2d8a508191961a9fd39485c4ac2a0f20ad8e2f931dc45c9ef"
}