Mocket Virus Detection

This YARA rule detects the Mocket virus by matching specific byte sequences within the Portable Executable (PE) file. The rule checks for the standard PE magic number (MZ header) and then looks for three distinct byte patterns at the entry point and other locations within the executable. This indicates the presence of the Mocket malware.