SEKOIA_Apt_Cloudatlas_Stagescalldllmainafterexec

rule SEKOIA_Apt_Cloudatlas_Stagescalldllmainafterexec
{
	meta:
		description = "Detects call to dllmain after execution of exported function"
		author = "Sekoia.io"
		id = "a24b7887-87f6-44e3-80c5-cd117e694595"
		date = "2023-10-31"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_cloudatlas_stagescalldllmainafterexec.yar#L1-L46"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "6d1c1717b4012e72b0069068158265dfd215cd7685a5489aba3de4a9024bfa28"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk_1 = {
        55
        8B EC
        83 EC 10
        C7 45 ?? 00 00 00 00
        83 7D ?? 00
        74 ??
        8B 45 ??
        89 45 ??
        8B 4D ??
        8B 51 ??
        03 55 ??
        89 55 ??
        8B 45 ??
        8B 48 ??
        03 4D ??
        89 4D ??
        6A 00
        6A 00
        FF 75 ??
        FF 55 ??
        68 00 80 00 00
        6A 00
        8B 55 ??
        52
        FF 15 ?? ?? ?? ??
        C7 45 ?? 01 00 00 00
        8B 45 ??
        8B E5
        5D
        C2 04 00
        }

	condition:
		any of them
}