Skip to content
yararules.org
Menu

YARA · SEKOIA.IO Community

SEKOIA_Pe_Princeransomware_Strings

Prince Ransomware exe files

MalwareSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X (with warnings)
Author
Sekoia.io
Date
2024-08-07
Modified
2024-12-19
Score / Quality
75 / 78

What this rule detects

Prince Ransomware exe files

Targets: Windows PE.

It defines 2 patterns (1 text, 1 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
pe-princeransomware-strings.yarDetection Rule License 1.1
rule SEKOIA_Pe_Princeransomware_Strings : FILE
{
	meta:
		description = "Prince Ransomware exe files"
		author = "Sekoia.io"
		id = "9c5cad6e-2b11-469c-ace1-2dc51562b035"
		date = "2024-08-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/pe_princeransomware_strings.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "8bd8de169f45e32bab53f6e06088836d6f0526105f03efa1faf84f3b02c43011"
		hash = "a83aad6861c8fdfe2392b8e286ab7051d223c6b0bbba5996165964f429657a37"
		logic_hash = "18577c5673b4fc5280dee88aefac3747c254a97fdc84b584af241277361f6400"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "https://i.imgur.com/RfsCOES.png" ascii
		$ = {596f75722066696c65732068617665206265656e20656e63727970746564207573696e67205072696e63652052616e736f6d77617265}

	condition:
		all of them and uint16( 0 ) == 0x5a4d and filesize > 1MB
}

Strings (2 patterns)

IdentifierTypeValueModifiers
$text"https://i.imgur.com/RfsCOES.png"ascii
$hex{596f75722066696c65732068617665206265656e20656e63727970746564207573696e67205072696e63652052616e736f6d77617265}

Condition

all of them and uint16( 0 ) == 0x5a4d and filesize > 1MB

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • The file must be larger than 1MB.
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 8bd8de169f45e32bab53f6e06088836d6f0526105f03efa1faf84f3b02c43011
  • a83aad6861c8fdfe2392b8e286ab7051d223c6b0bbba5996165964f429657a37

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 9c5cad6e-2b11-469c-ace1-2dc51562b035

Metadata

version1.0
classificationTLP:CLEAR

Tags:FILE

Related rules