FCT Ransomware Detection

This Yara rule detects the FCT ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of patterns related to how the ransomware locates files on a system and subsequently encrypts them. The `uint16(0) == 0x5A4D` condition ensures that the rule only applies to valid Windows executable files (MZ header).