tokens: Astrum was known to be have been exclusively used by the AdGholas malvertising campaign that delivered a plethora of threats including banking Trojans Dreambot/Gozi also known as Ursnif, and detected by Trend Micro as BKDR_URSNIF and RAMNIT TROJ_RAMNIT, PE_RAMNIT.