InfoDot Ransomware Detection

This YARA rule detects the InfoDot ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes ($find_files_p1, $find_files_p2, $find_files_p3, $find_files_p4) that are indicative of the ransomware's file enumeration logic, and another sequence ($encrypt_files) that signifies its encryption functionality. The rule requires all file finding patterns and the encryption pattern to be present within a Portable Executable (MZ header) to trigger, ensuring a high confidence detection of the InfoDot ransomware.