Update Yara_Neutrino.yar

2020-08-29 16:48:56 +02:00 · 2020-08-29 16:48:56 +02:00 · b438ede754
commit b438ede754
parent a2ece7475d
1 changed files with 1 additions and 1 deletions
--- a/Analysis/Neutrino/Yara/Yara_Neutrino.yar
+++ b/Analysis/Neutrino/Yara/Yara_Neutrino.yar
@ -36,6 +36,6 @@ rule Dropper_Neutrino_Feb_20 {
      $s19 = "x`FDbFdaFTcF^" fullword ascii
      $s20 = "jdXj2YC" fullword ascii
   condition:
-      uint16(0) == 0x5a4d and filesize < 300KB and
+      uint16(0) == 0x5a4d and filesize > 300KB and
      ( pe.imphash() == "934381a85d55af4033da1a769f2cce1d" or 8 of them )
 }