GandCrab Ransomware Detection

This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.