Khonsari Ransomware Detection

This YARA rule detects the Khonsari ransomware by identifying specific bytecode patterns related to file enumeration, key retrieval, and file encryption operations. The rule looks for distinct sequences of instructions that are characteristic of how Khonsari ransomware operates, ensuring that all three critical stages (finding files, obtaining an encryption key, and encrypting files) are present within the analyzed binary.