FLKR Ransomware Detection

This YARA rule detects the FLKR ransomware based on specific byte patterns found within its executable code. The rule uses three distinct byte sequences ($search_and_encrypt_p1, $search_and_encrypt_p2, $search_and_encrypt_p3) that are characteristic of the ransomware's search and encryption routines. The condition `uint16(0) == 0x5A4D` ensures that the scanned file is a valid Windows executable (MZ header), and `all of ($search_and_encrypt_p*)` requires all three byte patterns to be present for a match, reducing false positives.