[X]Updated

waterbear_IOCs {
  meta:
    creator = "Cpl Iverson"
    date = "2025-01-12"
    description = "Suspicious IPs, Hashes, and Domains"
    apt_group = "BlackTech"
  strings:
    $ip_45_77_181_203 = "45.77.181.203"
    $ip_103_40_112_228 = "103.40.112.228"
    $ip_59_125_119_202 = "59.125.119.202"
    $ip_139_180_201_6 = "139.180.201.6"
    $ip_139_162_112_74 = "139.162.112.74"
    $ip_172_104_92_110 = "172.104.92.110"
    $ip_168_95_1_1 = "168.95.1.1"
    $ip_45_76_218_116 = "45.76.218.116"
    $ip_108_160_138_235 = "108.160.138.235"
    $ip_211_72_242_120 = "211.72.242.120"
    $ip_108_160_132_108 = "108.160.132.108"
    $ip_220_135_71_92 = "220.135.71.92"
    $sha256_eed2ab9f = "eed2ab9f2c09e47c7689204ad7f91e5aef3cb25a41ea524004a48bb7dc59f969"
    $sha256_649675ba = "649675baef92381ffcdfa42e8959015e83c1ab1c7bbfd64635ce5f6f65efd651"
    $sha256_3f26a971 = "3f26a971e393d7f6ce7bf4416abdbfa1def843a0cf74d8b7bb841ca90f5c9ed9"
    $sha256_7532fe7a = "7532fe7a16ba1db4d5e8d47de04b292d94882920cb672e89a48d07e77ddd0138"
    $sha256_50ba9a22 = "50ba9a2235b9b67e16e6bd26ae042a958d065eb2c5273f07eee20ec86c58a653"
    $sha256_884cefcc = "884cefccd5b3c3a219a176c0c614834b5b6676abbac1d1c98f39624fccc71bf9"
    $sha256_7c0d2782 = "7c0d2782a33debb65b488893705e71a001ea06c4eb4fe88571639ed71ac85cdd"
    $sha256_4c05ee58 = "4c05ee584530fd9622b9e3be555c9132fad961848ea215ecb0dd9430df7e4ed8"
    $sha256_9c436db4 = "9c436db49b27bed20b42157b50d8bdad414b12f01e2127718250565017a08d84"
    $sha256_bda6812c = "bda6812c3bbba3c885584d234be353b0a2d1b1cbd29161deab0ef8814ac1e8e1"
    $sha256_78581711 = "7858171120792e5c98cfa75ccde7cba49e62a2aeb32ed62322aae0a80a50f1ea"
    $sha256_05d0ab2f = "05d0ab2fbeb7e0ba7547afb013d307d32588704daac9c12002a690e5c1cde3a4"
    $sha256_485d5af4 = "485d5af4ad86e9241abd824df7b3f7d658b1b77c7dcc3c9b74bfe1ddc074c87d"
    $sha256_6d40c289 = "6d40c289a154142cdd5298e345bcea30b13f26b9eddfe2d9634e71e1fb935fbe"
    $sha256_d4d5c73c = "d4d5c73c40f50cdef1500fca8329bc8f3f05f6e2ffda9c8feb9be1dcca6ccd31"
    $sha256_81a4b847 = "81a4b84700b5f4770b11a5fe30a8df42e5579fd622fd54143b3d2578df4b559d"
    $sha256_f2160168 = "f21601686a2af1a312e0f99effa2c2755f872b693534dbe14f034fa23587ac0b"
    $sha256_3fefceea = "3fefceeab9f845f9ddbe9c3a0712d45aad4c87fdbb178d13955944dbe6b338a3"
    $sha256_aa51b69d = "aa51b69d05741144d139b422c3b90fdf6d7d5a36dd6c7090c226a0fc155ada34"
    $sha256_9603b622 = "9603b62268c2bbb06da5c99572c3dc2ec988c49c86db2abc391acf53c1cccceb"
    $sha256_53402b66 = "53402b662679f0bfd08de3abb064930af40ff6c9ec95469ce8489f65796e36c3"
    $sha256_acb2abc7 = "acb2abc7fb44c2fdea0b65706d1e8b4c0bfb20e4bd4dcee5b95b346a60c6bd31"
    $sha256_dea5c564 = "dea5c564c9d961ccf2ed535139fbfca4f1727373504f2972ac92acfaf21da831"
    $sha256_f9f6bc63 = "f9f6bc637f59ef843bc939cb6be5000da5b9277b972904bf84586ea0a17a6000"
    $sha256_cb1a536e = "cb1a536e11ae1000c1b29233544377263732ca67cd679f3f6b20016fbd429817"
    $sha256_b9f3a3b9 = "b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361"
    $sha256_3277e3f3 = "3277e3f370319f667170fc7333fc5e081a0a87cb85b928219b3b3caf7f1e549c"
    $sha256_3d18bb8b = "3d18bb8b9a5af20ab10441c8cd40feff0aabdd3f4c669ad40111e3aa5e8c54b8"
    $sha256_abb91dfd = "abb91dfd95d11a232375d6b5cdf94b0f7afb9683fb7af3e50bcecdb2bd6cb035"
    $sha256_638cfbe6 = "638cfbe609d7f3e88767133be5ea5f9a75f1d703275f38eb9ec2414e179483b9"
    $sha256_5818bfe7 = "5818bfe75d73a92eb775fae3b876086a9e70e1e677b7c162b49fb8c1cc996788"
    $sha256_b32ab70f = "b32ab70f3f441a775771d6c824d4526715460c0fd72a1dfdec8cd531aef5fabd"
    $sha256_5a35672f = "5a35672f293f8f586fa9cfac0b09c2c52a85d4e8bc77b1ed4d7c16c58fe97a81"
    $sha256_a7f3b8af = "a7f3b8afb963528b4821b6151d259cf05ae970bc4400b805f7713bd8a0902a42"
    $sha256_73799d67 = "73799d67d32a2b5554c39330e81e7c8069feaa56520e22a7fd0a52e8857c510c"
    $sha256_8cd6dfff = "8cd6dfffc251f9571f7a82cca2eca09914c950f3b96aaaeaeaaeeac342f9b550"
    $sha256_28ca0c21 = "28ca0c218e14041b9f32a0b9a17d6ee5804e4ff52e9ef228a1f0f8b00ba24c11"
    $sha256_3909e837 = "3909e837f3a96736947e387a84bb57e57974db9b77fb1d8fa5d808a89f9a401b"
    $sha256_fcfdd079 = "fcfdd079b5861c0192e559c80e8f393b16ba419186066a21aab0294327ea9e58"
    $sha256_8da532ea = "8da532ea294cc2c99e02ce8513a15b108a7c49bd90f7001ce6148955304733cb"
    $sha256_9e3ecda0 = "9e3ecda0f8e23116e1e8f2853cf07837dd5bc0e2e4a70d927b37cfe4f6e69431"
    $sha256_69d60562 = "69d60562a8d69500e8cb47a48293894385743716e2214fd4e81682ab6ed1c46b"
    $sha256_35bd3c96 = "35bd3c96abbf9e4da9f7a4433d72f90bfe230e3e897a7aaf6f3d54e9ff66a05a"
    $sha256_39668008 = "39668008deb49a9b9a033fd01e0ea7c5243ad958afd82f79c1665fb73c7cfadf"
    $sha256_3442c076 = "3442c076c8824d5da065616063a6520ee1d9385d327779b5465292ac978dec26"
    $sha256_f11e2146 = "f11e2146b4b7da69112f4681daca0c5ec18917acc4cf4f78d8bff7ac0b53e15c"
    $sha256_c7c7b227 = "c7c7b2270767aaa2d66018894a7425ba6192730b4fe2130d290cd46af5cc0b7b"
    $sha256_6f970227 = "6f97022782d63c6cea53ad151c5b7e764e62533d8257e439033c0307437bfb2a"
    $domain_apple_wikaba_com = "apple.wikaba.com"
    $domain_itaiwans_com = "itaiwans.com"
    $domain_ntstore_hosthampster_com = "ntstore.hosthampster.com"
    $domain_asiainfo_hpcloudnews_com = "asiainfo.hpcloudnews.com"
    $domain_loop_microsoftmse_com = "loop.microsoftmse.com"
    $domain_microsoftmse_com = "microsoftmse.com"
    $domain_mx_msdtc_tw = "mx.msdtc.tw"
    $domain_naaakkk_wikaba_com = "naaakkk.wikaba.com"
    $domain_blog_mysecuritycamera_com = "blog.mysecuritycamera.com"
  condition:
    any of them
}