ZeroCrypt Ransomware Detection

This YARA rule detects the ZeroCrypt ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for three distinct patterns, `$encrypt_file_1`, `$encrypt_file_2`, and `$encrypt_file_3`, which are characteristic of the ZeroCrypt ransomware's encryption routines. Additionally, it verifies that the file is a Windows executable by checking for the 'MZ' magic bytes (uint16(0) == 0x5A4D).