Fix FPs in AgentRacoon

CAPESandbox · Dec 19, 2023 · 72047cb · 72047cb
1 parent f2338ca
commit 72047cb
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/data/yara/CAPE/AgentRacoon.yar b/data/yara/CAPE/AgentRacoon.yar
@@ -14,5 +14,5 @@ rule AgentRacoon {
         $s8 = ".telemetry." wide
         $s9 = "xn--" wide
     condition:
-      uint16(0) == 0x5a4d and 4 of them
+      uint16(0) == 0x5a4d and 7 of them
 }