Eternity Ransomware Bytecode Detection

This rule detects the Eternity ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines (including AES), and password handling. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The presence of all four string patterns ($find_files, $encrypt_files, $aes_encrypt, $encrypt_pass) strongly suggests the presence of Eternity ransomware.