MITRE ATT&CKsoftware (malware)

S0533 SLOTHFULMEDIA

Published 2020-11-16 Modified 2025-10-21 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
JackOfHearts, QueenOfClubs
Version
1.1
Created
2020-11-16

Description

SLOTHFULMEDIA is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017. It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe. In October 2020, Kaspersky Labs assessed SLOTHFULMEDIA is part of an activity cluster it refers to as "IAmTheKing". ESET also noted code similarity between SLOTHFULMEDIA and droppers used by a group it refers to as "PowerPool".

Related

Uses · MITRE ATT&CK (24)

  • T1680 Local Storage Discovery technique
  • T1071.001 Web Protocols sub-technique
  • T1569.002 Service Execution sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1056.001 Keylogging sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1543.003 Windows Service sub-technique
  • T1489 Service Stop technique
  • T1001 Data Obfuscation technique
  • T1005 Data from Local System technique
  • T1007 System Service Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1049 System Network Connections Discovery technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique
  • T1113 Screen Capture technique

References