/*
   SL-ADV-2026-WP-001 v16 — Remus Stealer / WP-002 ClickFix "Variant B"
   ClickFix (elevated Win+X shell) / EtherHiding — new C2 + screenshot-exfil
   Dispensight / SecureLeaf — secureleaf.dispensight.com — TLP:CLEAR — 2026-09-24
*/

rule WP002_ClickFix_variantB_elevated_lure_page
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v16"
        description = "Injected ClickFix lure DOM — elevated Win+X -> PowerShell(Admin) variant, RU or EN. Matches the injected shell even when the arming script is TDS-gated out."
        tlp = "CLEAR"
    strings:
        $ta   = "id=\"clipboard-text\"" ascii
        $cb   = "checkbox-container" ascii
        // elevated-shell instruction (RU + EN forms)
        $ru1  = "PowerShell (Admin)" ascii
        $ru2  = "\xD0\xBC\xD0\xB5\xD0\xBD\xD1\x8E \xD0\xB1\xD1\x8B\xD1\x81\xD1\x82\xD1\x80\xD1\x8B\xD1\x85" ascii  // "меню быстрых" (Quick Links)
        $en1  = "Quick Link" ascii nocase
        $cf   = "needs to review the security of your connection" ascii
    condition:
        ($ta and $cb) or ($cf and 1 of ($ru*,$en*))
}

rule WP002_ClickFix_variantB_failover_loader
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v16"
        description = "asseload cdn.js — 3-domain failover loader for the arming stage (asseload->cfsubs->helauth)."
        sha256 = "ba70a75c4b0d81e083fff510d0d6cc0c622cca3660cfa576e34ee899be7f72bc"
    strings:
        $d1 = "asseload.com/cdn/widget/a/" ascii
        $d2 = "cfsubs.com/cdn/widget/a/" ascii
        $d3 = "helauth.com/cdn/widget/a/" ascii
        $p  = "a4045c662b80.js" ascii
    condition:
        2 of ($d*) or $p
}

rule WP002_ClickFix_variantB_arming_stage
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v16"
        description = "Clipboard-arming stage a4045c662b80.js — XOR/base64 decoder family (v16 key qEXvNnc5bx0U). Characterization only; contains clipboard-write code."
        sha256 = "c5ef6b9f44e97d55d6a0deac0ef22118410c3114e7b5b97f4fc1b5b0c5b4a1e9"
    strings:
        $key = "qEXvNnc5bx0U" ascii
        $dec = ".charCodeAt(i%" ascii
        $ab  = "new Uint8Array(r.length)" ascii
        $ok  = "__dovOk" ascii
    condition:
        $key or ($dec and $ab) or $ok
}

rule WP002_ClickFix_variantB_helauth_c2_recon
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v16"
        description = "helauth.com recon/exfil C2 — html2canvas screenshotter (snap.js) + /hit beacon + /shot base64-JPEG screenshot exfil + /a/done poll."
        snap_sha256 = "e87e550794322e574a1fda0c1549a3c70dae5a93d9113417a429016838eab8cb"
    strings:
        $h  = "helauth.com" ascii nocase
        $b1 = "/cdn/widget/hit?s=" ascii
        $b2 = "/cdn/widget/shot?s=" ascii
        $b3 = "/cdn/widget/a/done" ascii
        $b4 = "/cdn/widget/snap.js" ascii
        $s  = "html2canvas" ascii
    condition:
        $h or 2 of ($b*) or ($s and 1 of ($b*))
}

rule WP002_ClickFix_variantB_etherhiding_contract
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v16"
        description = "BSC-testnet EtherHiding retrieval — v16 contract + selector."
    strings:
        $c   = "5bc946cd5121431c7a43549aee7f567e15176f9c" ascii nocase
        $sel = "0xe2179b8e" ascii nocase
        $rpc = "data-seed-prebsc-1-s1.binance.org" ascii
    condition:
        any of them
}