From 72047cb54071f39b455a63d39c9ad19ca0485208 Mon Sep 17 00:00:00 2001
From: ditekshen <ditekshen@outlook.com>
Date: Tue, 19 Dec 2023 15:16:25 +0300
Subject: [PATCH]  Fix FPs in AgentRacoon

---
 data/yara/CAPE/AgentRacoon.yar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/yara/CAPE/AgentRacoon.yar b/data/yara/CAPE/AgentRacoon.yar
index e4118da1..c48fe39b 100644
--- a/data/yara/CAPE/AgentRacoon.yar
+++ b/data/yara/CAPE/AgentRacoon.yar
@@ -14,5 +14,5 @@ rule AgentRacoon {
         $s8 = ".telemetry." wide
         $s9 = "xn--" wide
     condition:
-      uint16(0) == 0x5a4d and 4 of them
+      uint16(0) == 0x5a4d and 7 of them
 }