add Joao malware

clusters/tool.json

@@ -2953,6 +2953,15 @@
           "https://isc.sans.edu/diary/22736"
         ]
       }
+    },
+    {
+      "value": "Joao",
+      "description": "Spread via hacked Aeria games offered on unofficial websites, the modular malware can download and install virtually any other malicious code on the victim’s computer. To spread their malware, the attackers behind Joao have misused massively-multiplayer online role-playing games (MMORPGs) originally published by Aeria Games. At the time of writing this article, the Joao downloader was being distributed via the anime-themed MMORPG Grand Fantasia offered on gf.ignitgames[.]to.",
+      "meta": {
+        "refs": [
+          "https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/"
+        ]
+      }
     }
   ]
 }