Sherminator Ransomware Detection

This YARA rule detects the Sherminator ransomware by identifying specific byte patterns associated with its resource enumeration, file finding, and file encryption functions. The rule looks for distinct sequences of bytes within the executable, indicating the presence of Sherminator's core malicious functionalities. The condition `uint16(0) == 0x5A4D` ensures that the rule only applies to valid Windows Portable Executable (PE) files.