Hermes Ransomware Detection

This YARA rule detects the Hermes ransomware by identifying specific byte patterns associated with its file finding, encryption, and resource enumeration routines. The rule includes patterns for two different versions of Hermes ransomware, ensuring detection across variations of the malware. It specifically looks for the presence of a Windows executable (MZ header) and then checks for the unique byte sequences related to Hermes's operational functions.