{
	"id": "ab6c0283-960d-4de5-b0cf-fa6f83881806",
	"created_at": "2026-04-06T00:07:31.198482Z",
	"updated_at": "2026-04-10T13:12:15.758897Z",
	"deleted_at": null,
	"sha1_hash": "9f4151bc0434ca51e61b3f7a19814582a94530ab",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51205,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 22:52:14 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Kronos\n Tool: Kronos\nNames Kronos\nCategory Malware\nType Banking trojan, Info stealer\nDescription\nA banking trojan. This malware has been first advertised on the black market since around\nJune 2014, by an individual nicknamed VinnyK, writing in Russian.\nInformation\nMalpedia Last change to this tool card: 15 February 2023\nDownload this tool card in JSON format\nAll groups using tool Kronos\nChanged Name Country Observed\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=70c2c52a-5c97-41d0-81c1-fbbc96db344b\nPage 1 of 2\n\nAPT groups\r\n  MoneyTaker 2016  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=70c2c52a-5c97-41d0-81c1-fbbc96db344b\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=70c2c52a-5c97-41d0-81c1-fbbc96db344b\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=70c2c52a-5c97-41d0-81c1-fbbc96db344b"
	],
	"report_names": [
		"listgroups.cgi?u=70c2c52a-5c97-41d0-81c1-fbbc96db344b"
	],
	"threat_actors": [
		{
			"id": "746214d4-5d48-4644-b763-8e9a9c549c04",
			"created_at": "2022-10-25T16:07:23.878029Z",
			"updated_at": "2026-04-10T02:00:04.769032Z",
			"deleted_at": null,
			"main_name": "MoneyTaker",
			"aliases": [],
			"source_name": "ETDA:MoneyTaker",
			"tools": [
				"Kronos",
				"Metasploit",
				"MoneyTaker",
				"Screenshotter"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e5364c16-eb97-467e-a8c2-a720269498c1",
			"created_at": "2023-01-06T13:46:38.733469Z",
			"updated_at": "2026-04-10T02:00:03.082343Z",
			"deleted_at": null,
			"main_name": "MoneyTaker",
			"aliases": [],
			"source_name": "MISPGALAXY:MoneyTaker",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434051,
	"ts_updated_at": 1775826735,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9f4151bc0434ca51e61b3f7a19814582a94530ab.pdf",
		"text": "https://archive.orkl.eu/9f4151bc0434ca51e61b3f7a19814582a94530ab.txt",
		"img": "https://archive.orkl.eu/9f4151bc0434ca51e61b3f7a19814582a94530ab.jpg"
	}
}