From 8c2c47810ef696b102068c12d01cb6277b125fa2 Mon Sep 17 00:00:00 2001
From: Thanat0s <thanspam@trollprod.org>
Date: Fri, 24 Feb 2017 14:00:42 +0100
Subject: [PATCH] =?UTF-8?q?Locky=20removed=20>=20ransomware=C2=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 clusters/tool.json | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/clusters/tool.json b/clusters/tool.json
index eb7a68a..c2f5985 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -1119,10 +1119,6 @@
         ]
       }
     },
-    {
-      "value": "Locky",
-      "description": "Ransomware"
-    },
     {
       "value": "Necurs",
       "description": "The Necurs botnet is a distributor of many pieces of malware, most notably Locky.",
@@ -1394,6 +1390,7 @@
         "refs": [
           "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
         ]
+        ck
       }
     },
     {