NanoLocker Ransomware Detection

This rule detects the NanoLocker ransomware based on specific byte patterns found within its executable code. The patterns are associated with functions responsible for file encryption, communication with remote servers, and enumeration of shares for encryption. The rule requires all five defined byte patterns to be present in a PE file (identified by the 'MZ' header) to trigger, aiming to reduce false positives.