import "hash"

rule bulwark_https_bulwarkblack_com_unit_42_exposes_active_exploitation_of_beyondtrust_cve_2026_1731_
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/unit-42-exposes-active-exploitation-of-beyondtrust-cve-2026-1731-with-vshell-and-sparkrat-backdoors/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:58:09Z"
        tlp = "TLP:CLEAR"
        indicator_count = "47"
    strings:
        $s0 = "39uchxifap4cvgzsuirom0szrrg.d65lre9sfqnlcv49317gcis6pyjsatzho.oast.pro" ascii wide nocase  // Domains
        $s1 = "aliyundunupdate.xyz" ascii wide nocase  // Domains
        $s2 = "d65sb7ngveucv5k2nm508abdsjmbn7qmn.oast.pro" ascii wide nocase  // Domains
        $s3 = "judiemkqjajsfzpidfjlowgl8nyrtd49x.oast.fun" ascii wide nocase  // Domains
        $s4 = "oastify.com" ascii wide nocase  // Domains
        $s5 = "q0r2e5q2dzbykcox9qmkptm12s8mwb.oastify.com" ascii wide nocase  // Domains
        $s6 = "transfer.weepee.io" ascii wide nocase  // Domains
        $s7 = "http://134.122.13.34:8979/c" ascii wide nocase  // URLs
        $s8 = "http://39uchxifap4cvgzsuirom0szrrg.d65lre9sfqnlcv49317gcis6pyjsatzho.oast.pro" ascii wide nocase  // URLs
        $s9 = "http://64.31.28.221/support" ascii wide nocase  // URLs
        $s10 = "http://82.29.53.187:8778/app_cli" ascii wide nocase  // URLs
        $s11 = "http://85.155.186.121/access" ascii wide nocase  // URLs
        $s12 = "https://64.95.10.115:23011/update.sh" ascii wide nocase  // URLs
        $s13 = "https://85.155.186.121/access/Remote%20Access-linux64-offline.tar?language=en&app=76049110434275449312180081368257747094" ascii wide nocase  // URLs
        $s14 = "https://judiemkqjajsfzpidfjlowgl8nyrtd49x.oast.fun" ascii wide nocase  // URLs
        $s15 = "https://transfer.weepee.io/7nZw7/blue.drx" ascii wide nocase  // URLs
        $s16 = "oast.fun" ascii wide nocase  // URLs
        $s17 = "oast.pro" ascii wide nocase  // URLs
        $s18 = "weepee.io/7nZw7/blue.drx" ascii wide nocase  // URLs
        $s19 = "134.122.13.34" ascii wide nocase  // IPv4
        $s20 = "138.197.14.95" ascii wide nocase  // IPv4
        $s21 = "142.111.152.50" ascii wide nocase  // IPv4
        $s22 = "144.172.103.200" ascii wide nocase  // IPv4
        $s23 = "155.2.215.64" ascii wide nocase  // IPv4
        $s24 = "178.128.212.209" ascii wide nocase  // IPv4
        $s25 = "179.43.146.42" ascii wide nocase  // IPv4
        $s26 = "23.162.40.187" ascii wide nocase  // IPv4
        $s27 = "37.19.221.180" ascii wide nocase  // IPv4
        $s28 = "45.61.150.96" ascii wide nocase  // IPv4
        $s29 = "64.31.28.221" ascii wide nocase  // IPv4
        $s30 = "64.95.10.115" ascii wide nocase  // IPv4
        $s31 = "70.23.0.66" ascii wide nocase  // IPv4
        $s32 = "82.29.53.187" ascii wide nocase  // IPv4
        $s33 = "82.29.72.16" ascii wide nocase  // IPv4
        $s34 = "83.138.53.139" ascii wide nocase  // IPv4
        $s35 = "85.155.186.121" ascii wide nocase  // IPv4
        $s36 = "92.223.44.134" ascii wide nocase  // IPv4
        $s37 = "98.10.233.76" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac" or
        hash.sha256(0, filesize) == "4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e50" or
        hash.sha256(0, filesize) == "66cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726" or
        hash.sha256(0, filesize) == "679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb" or
        hash.sha256(0, filesize) == "98442387d466f27357d727b3706037a4df12a78602b93df973b063462a677761" or
        hash.sha256(0, filesize) == "98a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b" or
        hash.sha256(0, filesize) == "9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350" or
        hash.sha256(0, filesize) == "cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292" or
        hash.sha256(0, filesize) == "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce"
}