Elerad Virus Detection

This YARA rule detects the Elerad virus by searching for a specific byte sequence (signature) within the Portable Executable (PE) file, specifically at its entry point. The rule first checks if the file is a valid PE file by verifying the 'MZ' header (0x5A4D at offset 0). If it is a PE file, it then looks for the '$elerad_body' byte pattern at the file's entry point, indicating the presence of the Elerad malware.