ZeroLocker Ransomware Bytecode Detection

This rule detects the ZeroLocker ransomware by identifying specific bytecode patterns within executable files. The rule looks for three distinct encryption routine patterns ($encrypt_routine_1, $encrypt_routine_2, and $encrypt_routine_3) in files that start with the 'MZ' header (indicating a Windows executable). The presence of all three patterns strongly suggests the file is ZeroLocker ransomware.