From cfaadb0c71266c3d2d9ee7deb5820964e4bf7825 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Fri, 15 Dec 2017 09:57:39 +0100
Subject: [PATCH] add OSX.Pirrit

---
 clusters/tool.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/clusters/tool.json b/clusters/tool.json
index 4d7ca668..61965808 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -3146,6 +3146,20 @@
           "TRITON"
         ]
       }
+    },
+    {
+      "value": "OSX.Pirrit",
+      "description": "macOS adware strain ",
+      "meta": {
+        "refs": [
+          "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf",
+          "https://www2.cybereason.com/research-osx-pirrit-mac-adware",
+          "https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf"
+        ],
+        "synonyms": [
+          "OSX/Pirrit"
+        ]
+      }
     }
   ]
 }