PrincessLocker Ransomware Detection

This YARA rule detects the PrincessLocker ransomware by identifying specific byte sequences associated with its file encryption routines and remote connection functionalities. The rule looks for three distinct patterns: one related to file encryption operations and two related to establishing remote connections. All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.