Windows_Ransomware_Haron_a1c12e7e

rule Windows_Ransomware_Haron_a1c12e7e {
    meta:
        author = "Elastic Security"
        id = "a1c12e7e-a740-4d26-a0ed-310a2b03fe50"
        fingerprint = "c6abe96bd2848bb489f856373356dbad3fca273e9d71394ec22960070557ad11"
        creation_date = "2021-08-03"
        last_modified = "2021-10-04"
        description = "Direct overlap with Thanos/Avaddon"
        threat_name = "Windows.Ransomware.Haron"
        reference_sample = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
        severity = 90
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $a1 = { 00 04 28 0E 00 00 0A 06 FE 06 2A 00 00 06 73 0F 00 00 0A 28 }
    condition:
        any of them
}