Rokku Ransomware Detection

This YARA rule detects the Rokku ransomware by identifying specific byte patterns associated with its file encryption, file finding, and folder finding functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the Rokku ransomware's code for these operations. The condition requires the presence of the standard Windows executable MZ header (0x5A4D) and all defined byte patterns for finding folders, finding files, and encrypting files.