{
	"id": "c351a213-30b3-422c-803f-9d6d5de14832",
	"created_at": "2026-04-06T00:08:27.573316Z",
	"updated_at": "2026-04-10T03:36:08.304206Z",
	"deleted_at": null,
	"sha1_hash": "e75d6a6193ccc35ae2487e8ca6b07ff25167aeda",
	"title": "TerraStealer (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 28011,
	"plain_text": "TerraStealer (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 15:39:10 UTC\r\nAccording to QuoINT, TerraStealer (also known as SONE or StealerOne) is a generic reconnaissance tool,\r\ntargeting for example email clients, web browsers, and file transfer utilities. Attributed to Golden Chickens.\r\n[TLP:WHITE] win_terra_stealer_auto (20251219 | Detects win.terra_stealer.)\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_stealer\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.terra_stealer\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_stealer"
	],
	"report_names": [
		"win.terra_stealer"
	],
	"threat_actors": [
		{
			"id": "f5c90ccc-0f18-4e07-a246-b62101ab2f6f",
			"created_at": "2023-01-06T13:46:38.854407Z",
			"updated_at": "2026-04-10T02:00:03.122844Z",
			"deleted_at": null,
			"main_name": "GC02",
			"aliases": [
				"Golden Chickens",
				"Golden Chickens02",
				"Golden Chickens 02"
			],
			"source_name": "MISPGALAXY:GC02",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "88802a4b-5b3d-42ee-99e6-8a4f5fd231f6",
			"created_at": "2023-01-06T13:46:38.851345Z",
			"updated_at": "2026-04-10T02:00:03.121861Z",
			"deleted_at": null,
			"main_name": "GC01",
			"aliases": [
				"Golden Chickens",
				"Golden Chickens01",
				"Golden Chickens 01"
			],
			"source_name": "MISPGALAXY:GC01",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "7a257844-df90-4bd4-b0f1-77d00ff82802",
			"created_at": "2022-10-25T16:07:24.376356Z",
			"updated_at": "2026-04-10T02:00:04.964565Z",
			"deleted_at": null,
			"main_name": "Venom Spider",
			"aliases": [
				"Golden Chickens",
				"TA4557",
				"Venom Spider"
			],
			"source_name": "ETDA:Venom Spider",
			"tools": [
				"More_eggs",
				"PureLocker",
				"SONE",
				"SpicyOmelette",
				"StealerOne",
				"Taurus Builder",
				"Taurus Builder Kit",
				"Taurus Loader",
				"Taurus Loader Reconnaissance Module",
				"Taurus Loader Stealer Module",
				"Taurus Loader TeamViewer Module",
				"Terra Loader",
				"TerraCrypt",
				"TerraLogger",
				"TerraPreter",
				"TerraRecon",
				"TerraStealer",
				"TerraTV",
				"TerraWiper",
				"ThreatKit",
				"VenomKit",
				"VenomLNK",
				"lite_more_eggs"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434107,
	"ts_updated_at": 1775792168,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e75d6a6193ccc35ae2487e8ca6b07ff25167aeda.pdf",
		"text": "https://archive.orkl.eu/e75d6a6193ccc35ae2487e8ca6b07ff25167aeda.txt",
		"img": "https://archive.orkl.eu/e75d6a6193ccc35ae2487e8ca6b07ff25167aeda.jpg"
	}
}