Archiveus Ransomware Detection

This rule detects the Archiveus ransomware by identifying specific byte sequences ($entry_point, $dump_instruction, $extension_rule) within the Portable Executable (PE) file, combined with the presence of the string "INSTRUCTIONS HOW TO GET YOUR FILES BACK.txt". The rule checks for the MZ header (0x5A4D) and verifies that the $entry_point pattern is found at the PE entry point.