NotPetya Ransomware Detection

This YARA rule detects the NotPetya ransomware by identifying specific byte sequences (patterns) associated with its file encryption routine, main execution logic, encryption loop, and system shutdown/reboot mechanisms. The rule requires all four distinct byte patterns to be present within a file, along with the standard Windows PE header (MZ magic bytes), to trigger a detection. This combination of patterns aims to specifically identify NotPetya samples.