VHDLocker Ransomware Detection

This YARA rule detects the VHDLocker ransomware by identifying specific byte patterns (strings) associated with its file encryption routines, logical drive enumeration, and file finding mechanisms. The rule requires all three sets of patterns to be present in a file to trigger, indicating a high confidence detection for the VHDLocker malware.