JuicyLemon Ransomware Detection

This YARA rule detects the JuicyLemon ransomware by identifying specific byte sequences related to remote connections and file encryption routines. The rule looks for three distinct patterns: two associated with remote connection functionalities and one with the core logic for finding and encrypting files. All three patterns must be present, along with the standard Windows PE magic number (0x5A4D), to trigger a detection.