Dridex Trojan Malware Detection

This YARA rule detects the Dridex banking Trojan by identifying specific byte patterns (API wrapper functions and file search snippets) commonly found in its executables. The rule requires the file to be a Windows executable (MZ header) and contain at least one of the defined API wrapper patterns and one of the file search patterns.