Update mal_sophos_pygmy_nov24.yar

Neo23x0 · Nov 4, 2024 · 30b0714 · 30b0714
1 parent 875c757
commit 30b0714
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/yara/mal_sophos_pygmy_nov24.yar b/yara/mal_sophos_pygmy_nov24.yar
@@ -18,6 +18,8 @@ rule MAL_Sophos_XG_Pygmy_Goat_AES_Key {
       $dword_8 = { 55 51 50 77 }
    condition:
       uint32(0) == 0x464c457f and all of them
+      // due to FPs - but I don't know the file size of the implant 
+      and filesize < 4MB
 }
 
 rule MAL_Sophos_XG_Pygmy_Goat_Magic_Strings {