From 32d90a27e17b9dcddaf1827cdae9f83697da6612 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Mon, 22 Oct 2018 14:46:44 +0200
Subject: [PATCH] add GhostMiner

---
 clusters/tool.json | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/clusters/tool.json b/clusters/tool.json
index a26a738..da07a7d 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -7361,7 +7361,17 @@
       },
       "uuid": "d93894ee-d5d7-11e8-b360-572c0c441c8f",
       "value": "NAMEDPIPETOUCH"
+    },
+    {
+      "description": "GhostMiner is a new cryptocurrency mining malware. By the end of March 2018, a new variant of mining malware was detected targeting MSSQL, phpMyAdmin, and Oracle WebLogic servers. The sample uses Powershell to execute code with volatile resources and scans the server's processes to detect and stop other miners that might have been running prior to execution.\nThe fileless malware has become more popular in the last years. The malicious code runs directly in main memory without writing any file on disk, where an antivirus engine could detect it.",
+      "meta": {
+        "refs": [
+          "https://www.alienvault.com/forums/discussion/17301/alienvault-labs-threat-intelligence-update-for-usm-anywhere-march-25-march-31-2018"
+        ]
+      },
+      "uuid": "0a339826-d5f8-11e8-b520-5b93fe65a08e",
+      "value": "GhostMiner"
     }
   ],
-  "version": 96
+  "version": 97
 }