Windows_Ransomware_DragonForce_44bb8f0d

rule Windows_Ransomware_DragonForce_44bb8f0d {
    meta:
        author = "Elastic Security"
        id = "44bb8f0d-9648-426d-bd1c-0e16ccc8ad04"
        fingerprint = "990654f2598e9f9878ba61e0eeef67522cc6e851c49fc9ca4874131a26c120bb"
        creation_date = "2025-05-28"
        last_modified = "2026-02-02"
        threat_name = "Windows.Ransomware.DragonForce"
        reference_sample = "d06b5a200292fedcfb4d4aecac32387a2e5b5bb09aaab5199c56bab3031257d6"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $str_1 = "%04d-%02d-%02dT%02d:%02d:00Z" wide fullword
        $str_2 = ".dragonforce_encrypted" wide fullword
        $seq_1 = { C6 44 24 19 45 C6 44 24 1A 55 C6 44 24 1B 3C C6 44 24 1C 55 C6 44 24 1D 3A C6 44 24 1E 55 C6 44 24 1F 3F }
        $seq_2 = { C6 45 D4 00 C6 45 D5 4F C6 45 D6 69 C6 45 D7 28 C6 45 D8 69 C6 45 D9 1A C6 45 DA 69 C6 45 DB 3B C6 45 DC }
        $seq_3 = { C6 45 8C 00 C6 45 8D 55 C6 45 8E 02 C6 45 8F 4C C6 45 90 02 C6 45 91 73 C6 45 92 02 }
    condition:
        3 of them
}