Commit f14a60f2 by mmorenog

Update RomeoHotel.yara

parent fd56b86b
...@@ -40,7 +40,7 @@ rule RomeoHotel ...@@ -40,7 +40,7 @@ rule RomeoHotel
E8 4C 7C 00 00 call __allmul E8 4C 7C 00 00 call __allmul
*/ */
$diskSpace = { FF 15 [4] $diskSpace = {FF 15 [4]
85 C0 85 C0
74 ?? 74 ??
8B [6] 8B [6]
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment