BlueLocker Ransomware Detection

This rule detects the BlueLocker ransomware by identifying specific byte patterns related to its file encryption and file finding routines, as well as its cryptographic context creation. The rule looks for three distinct parts of the encryption process ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3), two parts of the file finding process ($find_files_p1, $find_files_p2), and a pattern for creating the cryptographic context ($create_crypt_context). All these patterns must be present for a detection to occur, indicating the presence of the BlueLocker ransomware.