SEKOIA_Ransomware_Win_Eking_Rich_Header

import "pe"
import "hash"

rule SEKOIA_Ransomware_Win_Eking_Rich_Header
{
	meta:
		description = "Detect Eking ransomware using its rich header"
		author = "Sekoia.io"
		id = "9fe76f89-f27a-4a47-a61c-2d767a1a8acb"
		date = "2021-10-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/ransomware_win_eking_rich_header.yar#L4-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "0028200fc2e929dba6fcc4ddf5d8e07825842e2f65c69ad94ebd032ae3748c90"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	condition:
		hash.md5( pe.rich_signature.clear_data ) == "256b60751602028612562b73ecdb163c"
}