Update Miscelanea.yar

Add rule to detect Spygate v2.9 Remote Access Trojan

malware/Miscelanea.yar

@@ -819,3 +819,19 @@ rule LightFTP_Config {
 	condition:
 		uint16(0) == 0xfeff and filesize < 1KB and all of them
 }
+rule SpyGate_v2_9
+{
+	meta:
+		date = "2014/09"
+		maltype = "Spygate v2.9 Remote Access Trojan"
+		filetype = "exe"
+		reference = "https://blogs.mcafee.com/mcafee-labs/middle-east-developer-spygate-struts-stuff-online"
+	strings:
+		$1 = "shutdowncomputer" wide
+		$2 = "shutdown -r -t 00" wide
+		$3 = "blockmouseandkeyboard" wide
+		$4 = "ProcessHacker"
+		$5 = "FileManagerSplit" wide
+	condition:
+		all of them
+}