{
	"id": "7ab63260-9179-4b11-ac91-1ca6db6e4a88",
	"created_at": "2026-04-06T00:19:59.461481Z",
	"updated_at": "2026-04-10T03:34:54.820462Z",
	"deleted_at": null,
	"sha1_hash": "0a328d3ee31d3bd1ddc90ac7ebfe24be21c1a3a8",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43200,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 17:43:55 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool DarkRAT\r\n Tool: DarkRAT\r\nNames DarkRAT\r\nCategory Malware\r\nType Backdoor\r\nDescription\r\n(PCRisk) DarkRAT is one of many remote access tools (RATs) used to control connected\r\ncomputers remotely. Unfortunately, in many cases, cyber criminals trick people into installing\r\nRATs onto their systems and then use them to steal personal details, infect systems with\r\nmalware, and cause other damage.\r\nInformation \u003chttps://www.pcrisk.com/removal-guides/15893-darkrat-malware\u003e\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/win.darkrat\u003e\r\nLast change to this tool card: 05 April 2022\r\nDownload this tool card in JSON format\r\nAll groups using tool DarkRAT\r\nChanged Name Country Observed\r\nAPT groups\r\n  TA2541 [Unknown] 2017  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5c89dfdf-2bc5-4cd2-a4dd-8d2caf447ddd\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5c89dfdf-2bc5-4cd2-a4dd-8d2caf447ddd\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5c89dfdf-2bc5-4cd2-a4dd-8d2caf447ddd"
	],
	"report_names": [
		"listgroups.cgi?u=5c89dfdf-2bc5-4cd2-a4dd-8d2caf447ddd"
	],
	"threat_actors": [
		{
			"id": "99468ac6-ccfd-4cd8-b726-791600e61431",
			"created_at": "2023-11-01T02:01:06.647272Z",
			"updated_at": "2026-04-10T02:00:05.313262Z",
			"deleted_at": null,
			"main_name": "TA2541",
			"aliases": [
				"TA2541"
			],
			"source_name": "MITRE:TA2541",
			"tools": [
				"Snip3",
				"Revenge RAT",
				"jRAT",
				"WarzoneRAT",
				"Imminent Monitor",
				"AsyncRAT",
				"NETWIRE",
				"Agent Tesla",
				"njRAT"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "97dc332f-2241-4755-ae33-54e5eff3990a",
			"created_at": "2023-01-06T13:46:39.307201Z",
			"updated_at": "2026-04-10T02:00:03.282272Z",
			"deleted_at": null,
			"main_name": "TA2541",
			"aliases": [],
			"source_name": "MISPGALAXY:TA2541",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "878ce40c-9fbc-4cff-a5c4-771086979fa7",
			"created_at": "2022-10-25T16:07:24.264056Z",
			"updated_at": "2026-04-10T02:00:04.915395Z",
			"deleted_at": null,
			"main_name": "TA2541",
			"aliases": [],
			"source_name": "ETDA:TA2541",
			"tools": [
				"AVE_MARIA",
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"AsyncRAT",
				"Ave Maria",
				"AveMariaRAT",
				"DarkRAT",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Imminent Monitor",
				"Imminent Monitor RAT",
				"Iniduoh",
				"Jenxcus",
				"Kognito",
				"Luminosity RAT",
				"LuminosityLink",
				"Negasteal",
				"NetWeird",
				"NetWire",
				"NetWire RAT",
				"NetWire RC",
				"NetWired RC",
				"Njw0rm",
				"Origin Logger",
				"Parallax",
				"Parallax RAT",
				"ParallaxRAT",
				"Recam",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"WSHRAT",
				"ZPAQ",
				"avemaria",
				"dinihou",
				"dunihi"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434799,
	"ts_updated_at": 1775792094,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0a328d3ee31d3bd1ddc90ac7ebfe24be21c1a3a8.pdf",
		"text": "https://archive.orkl.eu/0a328d3ee31d3bd1ddc90ac7ebfe24be21c1a3a8.txt",
		"img": "https://archive.orkl.eu/0a328d3ee31d3bd1ddc90ac7ebfe24be21c1a3a8.jpg"
	}
}