Sanwai Ransomware Detection

This rule detects the Sanwai ransomware based on specific byte patterns found within its executable code. The patterns '$find_files', '$import_key', and '$encrypt_files' are indicative of the ransomware's file searching, key importing, and file encryption functionalities. The rule also checks for the standard Windows executable magic number (MZ header).