Jormungand Ransomware Detection
This YARA rule detects the Jormungand ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include dropping a ransom note, encrypting files using AES and RSA algorithms, finding files to encrypt, and establishing remote connections. The rule specifically looks for these patterns within executable files (indicated by `uint16(0) == 0x5A4D` for MZ header).
YARA
