EngineBox malware added

clusters/tool.json

@@ -2944,6 +2944,15 @@
           "http://blog.trendmicro.com/trendlabs-security-intelligence/look-js_powmet-completely-fileless-malware/"
         ]
       }
+    },
+    {
+      "value": "EngineBox Malware",
+      "description": "The main malware capabilities include a privilege escalation attempt using MS16–032 exploitation; a HTTP Proxy to intercept banking transactions; a backdoor to make it possible for the attacker to issue arbitrary remote commands and a C&C through a IRC channel. As it's being identified as a Generic Trojan by most of VirusTotal (VT) engines, let s name it EngineBox— the core malware class I saw after reverse engineering it.",
+      "meta": {
+        "refs": [
+          "https://isc.sans.edu/diary/22736"
+        ]
+      }
     }
   ]
 }