MALWARE FAMILY

TerraStealer

Internal ID: win.terra_stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to QuoINT, TerraStealer (also known as SONE or StealerOne) is a generic reconnaissance tool, targeting for example email clients, web browsers, and file transfer utilities. Attributed to Golden Chickens.

Threat Analysis

TerraStealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://github.com/eset/malware-ioc/tree/master/evilnum

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→https://go.recordedfuture.com/hubfs/reports/cta-2025-0501.pdf

→https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9

→https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/

→https://twitter.com/3xp0rtblog/status/1275746149719252992

→https://www.recordedfuture.com/research/terrastealerv2-and-terralogger

→https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.terra_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search TerraStealer