WastedLocker Ransomware Detection

This YARA rule detects the WastedLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences, '$find_files_p*' and '$encrypt_files_p*', which are indicative of the ransomware's operational code. The presence of all these patterns, combined with the standard PE file magic number (0x5A4D), suggests the presence of the WastedLocker malware.