Thanatos Ransomware Detection

This YARA rule detects the Thanatos ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule requires the presence of the standard Windows executable MZ header (0x5A4D at offset 0) and specific byte sequences related to file enumeration and encryption functions within the binary.