type: malware
spec_version: 2.1
id: malware--feb2d7bb-aacb-48df-ad04-ccf41a30cd90
created: 2020-11-16T23:23:00.729Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0533
external_id: S0533
source_name: Costin Raiu IAmTheKing October 2020
description: Costin Raiu. (2020, October 2). Costin Raiu Twitter IAmTheKing SlothfulMedia. Retrieved September 12, 2024.
url: https://x.com/craiu/status/1311920398259367942
source_name: CISA MAR SLOTHFULMEDIA October 2020
description: DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
url: https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a
source_name: ESET PowerPool Code October 2020
description: ESET Research. (2020, October 1). ESET Research Tweet Linking Slothfulmedia and PowerPool. Retrieved September 12, 2024.
url: https://x.com/ESETresearch/status/1311762215490461696
source_name: Kaspersky IAmTheKing October 2020
description: Ivan Kwiatkowski, Pierre Delcher, Felix Aime. (2020, October 15). IAmTheKing and the SlothfulMedia malware family. Retrieved October 15, 2020.
url: https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/
source_name: QueenOfClubs
description: Kaspersky Labs assesses [SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) is an older variant of a malware family it refers to as the QueenOfClubs.(Citation: Kaspersky IAmTheKing October 2020)
source_name: JackOfHearts
description: Kaspersky Labs refers to the "mediaplayer.exe" dropper within [SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) as the JackOfHearts.(Citation: Kaspersky IAmTheKing October 2020)
source_name: USCYBERCOM SLOTHFULMEDIA October 2020
description: USCYBERCOM. (2020, October 1). USCYBERCOM Cybersecurity Alert SLOTHFULMEDIA. Retrieved September 12, 2024.
url: https://x.com/CNMF_CyberAlert/status/1311743710997159953
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T22:55:49.669Z
name: SLOTHFULMEDIA
description: [SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017.(Citation: CISA MAR SLOTHFULMEDIA October 2020)(Citation: Costin Raiu IAmTheKing October 2020) It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe.(Citation: USCYBERCOM SLOTHFULMEDIA October 2020)(Citation: Kaspersky IAmTheKing October 2020) 

In October 2020, Kaspersky Labs assessed [SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) is part of an activity cluster it refers to as "IAmTheKing".(Citation: Kaspersky IAmTheKing October 2020) ESET also noted code similarity between [SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) and droppers used by a group it refers to as "PowerPool".(Citation: ESET PowerPool Code October 2020) 
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Daniyal Naeem, BT Security
x_mitre_aliases: SLOTHFULMEDIA
JackOfHearts
QueenOfClubs