{
	"id": "d0a9e675-a353-460c-95b6-d7b6b0ac83ef",
	"created_at": "2026-04-06T15:53:26.450298Z",
	"updated_at": "2026-04-10T03:25:12.820164Z",
	"deleted_at": null,
	"sha1_hash": "a884c97dca85f9ab55156e48695cf621168f2fa3",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46042,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 15:48:06 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool QueenOfClubs\n Tool: QueenOfClubs\nNames\nQueenOfClubs\nSlothfulMedia\nCategory Malware\nType Backdoor, Info stealer\nDescription\n(Kaspersky) In the course of our investigations, we discovered another malware strain that\nappeared to fill the same role as QueenOfHearts. This C++ backdoor also offers similar\nfeatures as KingOfHearts, as well as the ability to execute arbitrary Powershell scripts. One\nminute difference is that in this one, screenshot capture capabilities are embedded directly into\nthe program instead of being handled by a separate utility.\nInformation\nMalpedia Last change to this tool card: 24 April 2021\nDownload this tool card in JSON format\nAll groups using tool QueenOfClubs\nChanged Name Country Observed\nAPT groups\n IAmTheKing 2018\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=144bd3d1-e6b4-4014-ad2a-ea2d32170c51\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=144bd3d1-e6b4-4014-ad2a-ea2d32170c51\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=144bd3d1-e6b4-4014-ad2a-ea2d32170c51"
	],
	"report_names": [
		"listgroups.cgi?u=144bd3d1-e6b4-4014-ad2a-ea2d32170c51"
	],
	"threat_actors": [
		{
			"id": "3262c97f-3311-49f5-807c-bcea4d8c9924",
			"created_at": "2022-10-25T16:07:23.717772Z",
			"updated_at": "2026-04-10T02:00:04.725048Z",
			"deleted_at": null,
			"main_name": "IAmTheKing",
			"aliases": [],
			"source_name": "ETDA:IAmTheKing",
			"tools": [
				"JackOfHearts",
				"KingOfHearts",
				"LaZagne",
				"Mimikatz",
				"ProcDump",
				"PsExec",
				"QueenOfClubs",
				"QueenOfHearts",
				"SLOTHFULMEDIA",
				"SlothfulMedia"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "adee5dfb-98d1-488f-969d-48eed28cd7e4",
			"created_at": "2023-01-06T13:46:38.799427Z",
			"updated_at": "2026-04-10T02:00:03.105089Z",
			"deleted_at": null,
			"main_name": "PowerPool",
			"aliases": [
				"IAmTheKing"
			],
			"source_name": "MISPGALAXY:PowerPool",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775490806,
	"ts_updated_at": 1775791512,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a884c97dca85f9ab55156e48695cf621168f2fa3.pdf",
		"text": "https://archive.orkl.eu/a884c97dca85f9ab55156e48695cf621168f2fa3.txt",
		"img": "https://archive.orkl.eu/a884c97dca85f9ab55156e48695cf621168f2fa3.jpg"
	}
}