IFN643 Ransomware Detection

This YARA rule detects the IFN643 ransomware by identifying specific byte patterns associated with its code. The rule looks for a Windows executable (MZ header) and then matches three distinct byte sequences, likely corresponding to its file searching and encryption functionalities. The rule's primary purpose is to identify the presence of this specific ransomware variant on a system.