CobraLocker Ransomware Detection

This YARA rule detects the CobraLocker ransomware by identifying specific bytecode patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns in the `encrypt_files` and `find_files` sections, along with checking for the MZ header (uint16(0) == 0x5A4D) to ensure it's an executable.