Nemty Ransomware Detection (YARA)

This YARA rule detects the Nemty ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The patterns are associated with Nemty's functionalities, including remote connection capabilities, enumeration of resources, file finding operations, and file encryption routines. The rule requires all defined string patterns to be present in a file that starts with the 'MZ' magic bytes (0x5A4D) to trigger a detection.