AvosLocker Ransomware Detection

This YARA rule detects the AvosLocker ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for patterns associated with file enumeration ($find_files), resource enumeration ($enum_resources), key import operations ($import_key), and file encryption routines ($encrypt_files). All four string patterns must be present in a file, and the file must start with the MZ header (0x5A4D) to be considered a match.