SEKOIA_Apt_Cloudatlas_Init_Module_Virtualalloc

rule SEKOIA_Apt_Cloudatlas_Init_Module_Virtualalloc : FILE
{
	meta:
		description = "Find init module of CloudAtlas with params passed to VirtualAlloc"
		author = "Sekoia.io"
		id = "299ed681-9d1f-4b47-8389-ff5a608f49d4"
		date = "2023-09-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_cloudatlas_init_module_virtualalloc.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "02a1a9582f5ccf421b08c41c35049416b9cdefc9228daf6b38d95e9b0930cc5a"
		hash = "c7f19c7c295c86867ea7fa4597ba0cebe12f751753866e7298fd5d84676facc3"
		logic_hash = "31ffaeccc0b8fe36eea3b3a8200eff6a420b1a3937fd439dc84121654fcea502"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk_1 = {
        6A 40
        68 00 30 10 00
        8B 8D ?? ?? ?? ??
        8B 51 50
        52
        6A 00
        FF 15 ?? ?? ?? ??
        }

	condition:
		( uint32be( 0 ) == 0x7f454c46 or uint16be( 0 ) == 0x4d5a ) and $chunk_1 and filesize < 3MB
}