Malware

SLOTHFULMEDIA

Also known asJackOfHeartsQueenOfClubs

SLOTHFULMEDIA is a Windows malware family associated with post-compromise surveillance, host reconnaissance, persistence, defense evasion, and data theft. Documented behavior includes enumerating running processes by process ID, name, and privilege level; collecting the current username; gathering system information; capturing screenshots of the victim desktop; uploading files and host data; and transmitting collected information to command-and-control infrastructure over HTTP and HTTPS POST requests. The malware also supports process injection, indicating use for stealthy execution within other processes.

The malware employs multiple defense-evasion and persistence measures. It has been observed setting itself hidden to reduce user visibility, masquerading under names resembling legitimate executables, modifying Windows Registry settings related to proxy or Internet zone configuration, and creating a Windows service named for persistence. It also performs cleanup and anti-forensic actions by deleting itself and removing browser-history-related artifacts from compromised systems.

Aliases associated with this malware include JackofHearts and QueenofClubs. The observed functionality is consistent with a backdoor-oriented implant used for espionage-style collection and remote operator tasking on Windows hosts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

2 techniques

T1112Modify RegistryEvidence5

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543.003Windows ServiceEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

T1543.003Windows ServiceEvidence1

Stealth

6 techniques

T1036MasqueradingEvidence2

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Akira has used legitimate names and locations for files to evade defenses.

T1055Process InjectionEvidence2

T1070Indicator RemovalEvidence1

Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'

T1070.004File DeletionEvidence4

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1564.001Hidden Files and DirectoriesEvidence2

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Defense Impairment

1 technique

T1112Modify RegistryEvidence5

Discovery

4 techniques

T1033System Owner/User DiscoveryEvidence5

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

T1057Process DiscoveryEvidence4

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence4

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1083File and Directory DiscoveryEvidence4

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

2 techniques

T1005Data from Local SystemEvidence1

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

T1113Screen CaptureEvidence1

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence5

ADVSTORESHELL exfiltrates data over the same channel used for C2.

ACTIVITY FEED

Recent activity

38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

38 SOURCESView more in app

mitre attack websiteNews

Oct 28, 2025

Updates | MITRE ATT&CK®

... SLOTHFULMEDIA ... (v1.0→v1.1) ...

mitre attack websiteNews

Oct 28, 2025

Updates - Updates - October 2025 | MITRE ATT&CK®

SLOTHFULMEDIA (v1.0→v1.1)

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Malware capable of injecting into running processes on a compromised host.

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that collects the username from a victim machine.

+34 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SLOTHFULMEDIA

Also known asJackOfHeartsQueenOfClubs