Kovter Ransomware Detection

This YARA rule detects the Kovter ransomware based on specific byte sequences found within the malware's executable. It looks for patterns related to remote connection functionalities, file enumeration, and payload decryption scripts, which are characteristic of Kovter's operation. The rule requires all identified string patterns to be present, along with a check for the MZ header (uint16(0) == 0x5A4D), indicating a Windows executable.