SeedLocker Ransomware Detection

This YARA rule detects the SeedLocker ransomware by identifying specific byte sequences ($search_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) within executable files. These sequences are indicative of the ransomware's file searching and encryption routines. The rule requires the presence of a valid MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, ensuring high confidence in detection.