Hive Ransomware is written in golang and appears to use a string obfuscation library.

This rule detected the samples I obtained from VX-Underground: https://samples.vx-underground.org/samples/Families/HiveRansomware/Paper/

rule hive_ransomware_string_obfuscation
{
	meta:
		description = "Hive Ransomware obfuscated strings"

	strings:
		$obfuscated1 = /[a-zA-Z0-9]{8}\.[a-zA-Z0-9_]{8}\.String\.func/
		$obfuscated2 = /[a-zA-Z0-9]{8}\.\(\*[a-zA-Z0-9]{8}\)\.[a-zA-Z0-9]{10}/

	condition:
		#obfuscated1 > 10 or #obfuscated2 > 10
}

YARA Rules Index