/*
   SL-ADV-2026-WP-001 v17 — Remus / WP-002 ClickFix "Variant C"
   Polygon EtherHiding · self-hosted C2 on AS202412 (Spamhaus DROP) · api.php beacon
   Dispensight / SecureLeaf — secureleaf.dispensight.com — TLP:CLEAR — 2026-09-28
*/

rule WP002_ClickFix_variantC_api_c2
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v17"
        description = "entry-verifed-cdn.codes /api.php C2 — base64-JSON beacon {action,k,os,vid,ref,ray}. Hosted directly on Omegatech AS202412 (178.16.52.101)."
        tlp = "CLEAR"
    strings:
        $dom  = "entry-verifed-cdn.codes" ascii nocase
        $p1   = "/api.php?s=" ascii
        $p2   = "/api.php?k=" ascii
        $key  = "a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402" ascii
        $j    = "\"action\":\"dl\"" ascii
        $jv   = "\"vid\":\"" ascii
    condition:
        $dom or $key or (1 of ($p*) and 1 of ($j,$jv))
}

rule WP002_ClickFix_variantC_polygon_etherhiding
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v17"
        description = "EtherHiding migrated to Polygon — RPC endpoint used to retrieve the injector contract (v17)."
    strings:
        $rpc = "polygon-bor-rpc.publicnode.com" ascii nocase
        $sel = "0xe2179b8e" ascii nocase
        $m   = "eth_call" ascii
    condition:
        $rpc or ($sel and $m)
}

rule WP002_ClickFix_variantC_arming_js
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v17"
        description = "obfuscator.io-style arming stage served by api.php (658KB). Characterization only."
        sha256 = "51d4def852645a4f7a436abe7aa4498d08f57395e2f40e3c17cdb3f95d03f2d2"
    strings:
        $o1 = "var _0x" ascii
        $o2 = { 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 78 }   // "(function(){\nvar x"
        $g  = "gogreenlightloans" ascii nocase
    condition:
        ($o1 and filesize > 200KB) or $o2 or $g
}

rule WP002_ClickFix_variantC_lure_page
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v17"
        description = "Injected ClickFix lure DOM (shared across variants) + v17 stager reference."
    strings:
        $ta = "id=\"clipboard-text\"" ascii
        $cb = "checkbox-container" ascii
        $cf = "needs to review the security of your connection" ascii
        $st = "entry-verifed-cdn.codes" ascii nocase
    condition:
        ($ta and $cb) or ($cf and $st) or $st
}