rule Linux_Ransomware_Note_Strict
{
    meta:
        description = "Ransom note embedded. Zero FP su file non ELF."
        author = "BastionGuard"

    strings:
        $msg1 = "All your files have been encrypted" wide ascii
        $msg2 = "To recover your files" wide ascii
        $msg3 = "bitcoin" ascii

    condition:
        uint32(0) == 0x7f454c46 and    // NON MATCHA MAI .zsh_history
        any of ($msg*)
}