From 120b2581cf9a4b90af2bbe82bfb1c85748acb160 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Fri, 30 Dec 2016 11:39:23 +0100
Subject: [PATCH] DownRage added

---
 clusters/tool.json | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/clusters/tool.json b/clusters/tool.json
index 3272a20..6c44d9c 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -1073,9 +1073,14 @@
     },
     {
         "value": "Incognito RAT"
+    },
+    {
+        "value": "DownRage",
+        "synonyms": ["Carberplike"],
+        "refs": ["https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/", "https://twitter.com/Timo_Steffens/status/814781584536719360"]
     }
 ],
-  "version": 6,
+  "version": 7,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "author": [