Skystars Ransomware Detection

This Yara rule detects the Skystars ransomware. It identifies specific byte patterns ($search_files_p1, $search_files_p2, $encrypt_files, $main_routine) within executable files that are characteristic of the Skystars ransomware's file searching, encryption, and main routine functionalities. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, indicating a high confidence match for the malware.