Windows_Ransomware_Haron_23b76cb7

rule Windows_Ransomware_Haron_23b76cb7 {
    meta:
        author = "Elastic Security"
        id = "23b76cb7-6f96-4012-ad66-2e4e4ae744a9"
        fingerprint = "9dc91a56ef17873f3e833d85fa947facde741d80a574ae911261e553a40a2731"
        creation_date = "2021-08-03"
        last_modified = "2021-10-04"
        description = "Direct overlap with Thanos/Avaddon"
        threat_name = "Windows.Ransomware.Haron"
        reference_sample = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
        severity = 90
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $a1 = { 0A 28 06 00 00 06 26 DE 0A 08 2C 06 08 6F 48 00 00 0A DC DE }
    condition:
        any of them
}