From 2d658a657779df6087ab92e61091614f5d894b22 Mon Sep 17 00:00:00 2001
From: Thanat0s <Thanspam@trollprod.org>
Date: Sun, 26 Feb 2017 22:53:51 +0100
Subject: [PATCH] pimp comrat

---
 clusters/tool.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/clusters/tool.json b/clusters/tool.json
index 46a361bf..645896e1 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -491,9 +491,16 @@
     },
     {
       "value": "Agent.BTZ",
+      "description": "In November 2014, the experts of the G DATA SecurityLabs published an article about ComRAT, the Agent.BTZ successor. We explained that this case is linked to the Uroburos rootkit.",
       "meta": {
         "synonyms": [
           "ComRat"
+        ],
+        "refs": [
+          "https://blog.gdatasoftware.com/2015/01/23927-evolution-of-sophisticated-spyware-from-agent-btz-to-comrat"
+        ],
+        "type": [
+          "Backdoor"
         ]
       }
     },