diff --git a/yara/indicator_office.yar b/yara/indicator_office.yar
index 7e012a8..c5c89c9 100644
--- a/yara/indicator_office.yar
+++ b/yara/indicator_office.yar
@@ -73,14 +73,15 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1 {
         description = "Detects RTF documents potentially exploiting CVE-2017-11882"
         author = "ditekSHen"
     strings:
-        // 0002CE02-0000-0000-C000-000000000046: Equation
-        // CVE-2017-11882 or CVE-2018-0802
-        $s1 = "02ce020000000000c000000000000046" ascii nocase
+        // 0002CE02-0000-0000-C000-000000000046: Equation <> CVE-2017-11882 or CVE-2018-0802
+        $s1 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36}
         // Root Entry
         $s2 = "52006f006f007400200045006e00740072007900" ascii nocase
+        // bin0
+        $s3 = "\\bin0" ascii nocase
         // OLE Signature
-        $ole1 = "d0cf11e0a1b11ae1" ascii nocase
-        $olex = { (64|44)[0-1]30[0-1](63|43)[0-1](66|46)[0-1]31[0-1]31[0-1](65|45)[0-1]30[0-1](61|41)[0-1]31[0-1](62|42)[0-1]31[0-1]31[0-1](61|41) }
+        $ole = { (64|44)[0-20]30[0-20](63|43)[0-20](66|46)[0-20]31[0-20]31[0-20](65|45)[0-20]30[0-20](61|41)[0-20]31[0-20](62|42)[0-20]31[0-20]31[0-20](61|41) }
+        //$ole1 = "d0cf11e0a1b11ae1" ascii nocase
         //$ole2 = { 6430 [0-1] 6366 [0-1] 3131 [0-1] 6530 [0-1] 6131 [0-1] 6231 [0-1] 3161 }
         //$ole3 = { 4430 [0-1] 4346 [0-1] 3131 [0-1] 4530 [0-1] 4131 [0-1] 4231 [0-1] 3141 }
         //$ole4 = { 64[0-1]30[0-1]63[0-1]66[0-1]31[0-1]31[0-1]65[0-1]30[0-1]61[0-1]31[0-1]62[0-1]31[0-1]31[0-1]61 }
@@ -93,7 +94,7 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1 {
         $obj5 = "\\objautlink" ascii
         $obj6 = "\\objlink" ascii
     condition:
-      uint32(0) == 0x74725c7b and all of ($s*) and 1 of ($ole*) and 2 of ($obj*)
+      uint32(0) == 0x74725c7b and 2 of ($s*) and $ole and 2 of ($obj*)
 }
 
 rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_2 {
@@ -106,6 +107,7 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_2 {
         $eq1 = "02ce020000000000c000000000000046" ascii nocase
         $eq2 = "equation." ascii nocase
         $eq3 = "6551754174496f4e2e33" ascii nocase
+        $eq4 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36 }
         // Embedded Objects
         $obj1 = "\\objhtml" ascii
         $obj2 = "\\objdata" ascii
@@ -132,10 +134,12 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_3 {
         // Ole10Native
         $ole1 = "4f006c006500310030004e00410054004900760065" ascii nocase
         $ole2 = { (3666|3466) (3663|3463) (3635|3435) 3331 3330 (3665|3465) (3631|3431) (3734|3534) (3639|3439) (3736|3536) (3635|3435) }
+        $ole3 = { (4f|6f)[0-5](4c|6c)[0-5](45|65)[0-5]30[0-5](4e|6e)[0-5](41|61)[0-5](54|74)[0-5](49|69)[0-5](56|76)[0-5](45|65) }
         // CVE-2017-11882 or CVE-2018-0802
         // 0002CE02-0000-0000-C000-000000000046: Equation
         $clsid1 = "2ce020000000000c000000000000046" ascii nocase
         $clsid2 = { 32 (43|63) (45|65) 30 32 30 30 30 30 30 30 30 30 30 30 (43|63) 30 30 30 30 30 30 30 30 30 30 30 30 30 34 36 }
+        $clsid3 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36 }
         // Root Entry
         $re = "52006f006f007400200045006e00740072007900" ascii nocase
         // Embedded Objects
@@ -157,8 +161,9 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_4 {
     strings:
         // equation.3 manipulated
         // is slowing down scanning, but good detection rate
-        $s1 = { (36|34)[0-5]35[0-5](37|35)[0-5]31[0-5](37|35)[0-5]35[0-5](36|34)[0-5]31[0-5](37|35)[0-5]34[0-5](36|34)[0-5]39[0-5](36|34)[0-5]66[0-5](36|34)[0-5]65[0-5]32[0-5]65[0-5]33[0-5]33 }
-        $s2 = { (7d|5c|2b|24)[0-5](37|35)[0-5]31[0-5](37|35)[0-5]35[0-5](36|34)[0-5]31[0-5](37|35)[0-5]34[0-5](36|34)[0-5]39[0-5](36|34)[0-5]66[0-5](36|34)[0-5]65[0-5]32[0-5]65[0-5]33[0-5]33 }
+        $s1 = { (36|34)[0-50]35[0-50](37|35)[0-50]31[0-50](37|35)[0-50]35[0-50](36|34)[0-50]31[0-50](37|35)[0-50]34[0-50](36|34)[0-50]39[0-50](36|34)[0-50]66[0-50](36|34)[0-50]65[0-50]32[0-50]65[0-50]33[0-50]33 }
+        $s2 = { (7d|5c|2b|24)[0-50](37|35)[0-50]31[0-50](37|35)[0-50]35[0-50](36|34)[0-50]31[0-50](37|35)[0-50]34[0-50](36|34)[0-50]39[0-50](36|34)[0-50]66[0-50](36|34)[0-50]65[0-50]32[0-50]65[0-50]33[0-50]33 }
+        $s3 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36 }
         // NOT slowing down scanning, but FN prone
         // $s3 = { (36|34)[0-1]35[0-1](37|35)[0-1]31[0-1](37|35)[0-1]35[0-1](36|34)[0-1]31[0-1](37|35)[0-1]34[0-1](36|34)[0-1]39[0-1](36|34)[0-1]66[0-1](36|34)[0-1]65[0-1]3265[0-1]3333 }
         //$s4 = { (7d|5c|2b|24)[0-1](37|35)[0-1]31[0-1](37|35)[0-1]35[0-1](36|34)[0-1]31[0-1](37|35)[0-1]34[0-1](36|34)[0-1]39[0-1](36|34)[0-1]66[0-1](36|34)[0-1]65[0-1]3265[0-1]3333 }
diff --git a/yara/malware.yar b/yara/malware.yar
index 084bddf..2fba773 100644
--- a/yara/malware.yar
+++ b/yara/malware.yar
@@ -11317,3 +11317,43 @@ rule MALWARE_Win_PWSHDLLDL {
     condition:
         uint16(0) == 0x5a4d and pe.is_dll() and 5 of them
 }
+
+rule MALWARE_Win_NPPSpy {
+    meta:
+        author = "ditekShen"
+        description = "Detects NPPSpy / Ntospy"
+    strings:
+        $s1 = "ntskrnl.dll" fullword ascii
+        $s2 = "PasswordStealing.dll" fullword ascii
+        $s3 = "ntoskrnl.dll" fullword ascii
+        $s4 = "\\programdata\\packag~" ascii
+        $s5 = "NPPSPY.dll" fullword ascii
+        $s6 = "MSControll.dll" fullword ascii
+        $s7 = "\\Windows\\Temp\\" ascii
+        $s8 = "\\NPPSpy\\" ascii
+        // hunt
+        $s9 = "NPGetCaps" fullword ascii
+        $s10 = "NPLogonNotify" fullword ascii
+        // C:\Users\GrzegorzTworek\source\repos\NPPSpy\x64\Release\NPPSPY.pdb
+        $path = "\\GrzegorzTworek\\" ascii
+    condition:
+      uint16(0) == 0x5a4d and ((pe.is_dll() and filesize < 110KB and pe.number_of_exports == 2 and ((pe.exports("NPGetCaps") and pe.exports("NPLogonNotify")) or (1 of ($s*) and (pe.exports("NPGetCaps") or pe.exports("NPLogonNotify"))))) or (($path) and any of ($s*)))
+}
+
+rule MALWARE_Win_AgentRacoon {
+    meta:
+        author = "ditekShen"
+        description = "Detects AgentRacoon. Not Raccoon"
+    strings:
+        $s1 = "UdpClient" fullword ascii
+        $s2 = "IPEndPoint" fullword ascii
+        $s3 = "get_Client" fullword ascii
+        $s4 = "set_ReceiveTimeout" fullword ascii
+        $s5 = "Command failed:" wide
+        $s6 = "uploaded" wide
+        $s7 = "downloaded" wide
+        $s8 = ".telemetry." wide
+        $s9 = "xn--" wide
+    condition:
+      uint16(0) == 0x5a4d and 4 of them
+}