From 9aa6244ed909d58e016898350f661deae29feb76 Mon Sep 17 00:00:00 2001
From: rmkml <rmkml@yahoo.fr>
Date: Sat, 13 Apr 2019 17:01:31 +0200
Subject: [PATCH] Add Ave Maria Stealer

---
 clusters/stealer.json | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/clusters/stealer.json b/clusters/stealer.json
index 7511a0b..105639f 100644
--- a/clusters/stealer.json
+++ b/clusters/stealer.json
@@ -65,7 +65,18 @@
       },
       "uuid": "a646edaa-4c6f-3a79-7a6c-143535259e15",
       "value": "Vidar"
+    },
+    {
+      "description": "Information stealer which uses AutoIT for wrapping.",
+      "meta": {
+        "date": "Jan 2019.",
+        "refs": [
+          "https://blog.yoroi.company/research/the-ave_maria-malware/"
+        ]
+      },
+      "uuid": "a546edaa-4c6f-2a79-7a6c-133535249e14",
+      "value": "Ave Maria"
     }
   ],
-  "version": 5
+  "version": 6
 }