FenixLocker Ransomware Detection

This YARA rule detects the FenixLocker ransomware by identifying specific byte sequences ($encrypt_files_1, $encrypt_files_2, $encrypt_files_3, $encrypt_files_4, $encrypt_files_5) within executable files. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) indicating a Windows executable, along with a combination of these byte sequences to trigger. The identified byte sequences are indicative of the ransomware's file encryption routines.