TBLocker Ransomware Detection

This YARA rule detects the TBLocker ransomware by identifying specific byte patterns within the executable. It looks for distinct sequences of bytes associated with the ransomware's main functions, including those responsible for searching and encrypting files. The rule requires all parts of the main ransomware function patterns, along with the file search and encryption patterns, to be present in a PE (Portable Executable) file (indicated by `uint16(0) == 0x5A4D`) to trigger a detection.