diff --git a/clusters/stealer.json b/clusters/stealer.json
index 7511a0b..105639f 100644
--- a/clusters/stealer.json
+++ b/clusters/stealer.json
@@ -65,7 +65,18 @@
       },
       "uuid": "a646edaa-4c6f-3a79-7a6c-143535259e15",
       "value": "Vidar"
+    },
+    {
+      "description": "Information stealer which uses AutoIT for wrapping.",
+      "meta": {
+        "date": "Jan 2019.",
+        "refs": [
+          "https://blog.yoroi.company/research/the-ave_maria-malware/"
+        ]
+      },
+      "uuid": "a546edaa-4c6f-2a79-7a6c-133535249e14",
+      "value": "Ave Maria"
     }
   ],
-  "version": 5
+  "version": 6
 }