import "hash"

rule bulwark_https_bulwarkblack_com_turla_stockstay_backdoor_egress_visibility
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/turla-stockstay-backdoor-egress-visibility/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:58:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "73"
    strings:
        $s0 = "basecon.com" ascii wide nocase  // Domains
        $s1 = "basecon.com.ua" ascii wide nocase  // Domains
        $s2 = "canal1zac1a.onrender.com" ascii wide nocase  // Domains
        $s3 = "circoloesteri.elezioni.idnet.it" ascii wide nocase  // Domains
        $s4 = "driverx86-adobe.onrender.com" ascii wide nocase  // Domains
        $s5 = "google-ai-labs-it.onrender.com" ascii wide nocase  // Domains
        $s6 = "online.zp.ua" ascii wide nocase  // Domains
        $s7 = "stream.bybit.com" ascii wide nocase  // Domains
        $s8 = "ukr.net" ascii wide nocase  // Domains
        $s9 = "weatherdataai.theworkpc.com" ascii wide nocase  // Domains
        $s10 = "wool-basalt-clock.glitch.me" ascii wide nocase  // Domains
        $s11 = "ws-api.binance.com" ascii wide nocase  // Domains
        $s12 = "ws-feed-public.sandbox.exchange.coinbase.com" ascii wide nocase  // Domains
        $s13 = "ws-feed.exchange.coinbase.com" ascii wide nocase  // Domains
        $s14 = "www.circoloesteri.it" ascii wide nocase  // Domains
        $s15 = "www.drs.gov.ua" ascii wide nocase  // Domains
        $s16 = "https://basecon.com.ua/calculator.rar" ascii wide nocase  // URLs
        $s17 = "https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php" ascii wide nocase  // URLs
        $s18 = "https://online.zp.ua/wp-content/uploads/Tools/EditorToolsPdf.zip" ascii wide nocase  // URLs
        $s19 = "https://www.circoloesteri.it/" ascii wide nocase  // URLs
        $s20 = "https://www.drs.gov.ua/wp-content/themes/twentytwentyfive/docs.zip" ascii wide nocase  // URLs
        $s21 = "4.4.3.12" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b" or
        hash.sha256(0, filesize) == "0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4" or
        hash.sha256(0, filesize) == "1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851" or
        hash.sha256(0, filesize) == "19e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9" or
        hash.sha256(0, filesize) == "1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f" or
        hash.sha256(0, filesize) == "1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24" or
        hash.sha256(0, filesize) == "249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb" or
        hash.sha256(0, filesize) == "2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7" or
        hash.sha256(0, filesize) == "2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0" or
        hash.sha256(0, filesize) == "34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b" or
        hash.sha256(0, filesize) == "3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14" or
        hash.sha256(0, filesize) == "391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e" or
        hash.sha256(0, filesize) == "40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3" or
        hash.sha256(0, filesize) == "40b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50" or
        hash.sha256(0, filesize) == "447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4" or
        hash.sha256(0, filesize) == "45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893" or
        hash.sha256(0, filesize) == "4e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320" or
        hash.sha256(0, filesize) == "55249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c" or
        hash.sha256(0, filesize) == "626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459" or
        hash.sha256(0, filesize) == "6298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e" or
        hash.sha256(0, filesize) == "667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a38" or
        hash.sha256(0, filesize) == "6cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b" or
        hash.sha256(0, filesize) == "6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342" or
        hash.sha256(0, filesize) == "7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78" or
        hash.sha256(0, filesize) == "77417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a82244167" or
        hash.sha256(0, filesize) == "80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661" or
        hash.sha256(0, filesize) == "813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d5" or
        hash.sha256(0, filesize) == "81aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac" or
        hash.sha256(0, filesize) == "82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb" or
        hash.sha256(0, filesize) == "9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec" or
        hash.sha256(0, filesize) == "98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397" or
        hash.sha256(0, filesize) == "9fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73" or
        hash.sha256(0, filesize) == "a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ce" or
        hash.sha256(0, filesize) == "b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cff" or
        hash.sha256(0, filesize) == "b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89" or
        hash.sha256(0, filesize) == "b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636" or
        hash.sha256(0, filesize) == "b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5a" or
        hash.sha256(0, filesize) == "c905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9" or
        hash.sha256(0, filesize) == "d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e" or
        hash.sha256(0, filesize) == "d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43" or
        hash.sha256(0, filesize) == "d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3" or
        hash.sha256(0, filesize) == "da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40" or
        hash.sha256(0, filesize) == "dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22" or
        hash.sha256(0, filesize) == "e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722" or
        hash.sha256(0, filesize) == "e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714" or
        hash.sha256(0, filesize) == "e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8" or
        hash.sha256(0, filesize) == "e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ff" or
        hash.sha256(0, filesize) == "e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6" or
        hash.sha256(0, filesize) == "e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3" or
        hash.sha256(0, filesize) == "f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99ed" or
        hash.sha256(0, filesize) == "f964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da"
}