Update Miscelanea.yar

malware/Miscelanea.yar

@@ -1250,4 +1250,24 @@ rule Ap0calypse
 	condition:
 		all of them
 }
+rule Arcom
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Arcom"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+        $a1 = "CVu3388fnek3W(3ij3fkp0930di"
+        $a2 = "ZINGAWI2"
+        $a3 = "clWebLightGoldenrodYellow"
+        $a4 = "Ancestor for '%s' not found" wide
+        $a5 = "Control-C hit" wide
+        $a6 = {A3 24 25 21}
+        
+    condition:
+        all of them
+}