Windows_Ransomware_Blackmatter_8394f6d5

rule Windows_Ransomware_Blackmatter_8394f6d5 {
    meta:
        author = "Elastic Security"
        id = "8394f6d5-4761-4df6-974d-eaa0a25353da"
        fingerprint = "3825f59ffe9b2adc1f9dd175f4d57c9aa3dd6ff176616ecbe7c673b5b4d414f8"
        creation_date = "2021-08-03"
        last_modified = "2021-10-04"
        threat_name = "Windows.Ransomware.Blackmatter"
        reference_sample = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $a1 = { FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 }
    condition:
        any of them
}