BlackMoon Ransomware Detection

This YARA rule detects the BlackMoon ransomware by identifying specific byte patterns related to file enumeration and encryption routines. The rule looks for a combination of a standard PE file header (MZ header) and distinct byte sequences associated with how BlackMoon ransomware finds and encrypts files.