Procedure examples

BOLDMOVE performs system survey actions following initial execution.

Crimson contains a command to collect the victim PC name and operating system.

DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.

Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.

BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.

Machete collects the hostname of the target computer.

Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.

Avenger has the ability to identify the OS architecture on a compromised host.

A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.

PUBLOAD has collected and sent system information including volume serial number, computer name, and system uptime to designated C2. PUBLOAD has also used several commands executed in sequence via `cmd` in a short interval to gather system information about the infected host including `systeminfo`. PUBLOAD has decrypted shellcode that collects the computer name.

SystemBC has collected username , build number and serial number, then sent the information to the C2 server. SystemBC has also gathered device name, operating system, and processor type.

Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.

PingPull can retrieve the hostname of a compromised host.

WellMess can identify the computer name of a compromised host.

DropBook has checked for the presence of Arabic language in the infected machine's settings.

Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, and environment variables.

Mafalda can collect the computer name of a compromised host.

KARAE can collect system information.

Squirrelwaffle has gathered victim computer information and configurations.

HexEval Loader has identified the OS and MAC address of victim device through host fingerprinting scripting.

AuTo Stealer has the ability to collect the hostname and OS information from an infected host.

ShrinkLocker uses WMI queries to gather various information about the victim machine and operating system.

Hildegard has collected the host's OS, CPU, and memory information.

SLOWDRIFT collects and sends system information to its C2.

SHUTTERSPEED can collect system information.

SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.

Snip3 has the ability to query `Win32_ComputerSystem` for system information.

Rifdoor has the ability to identify the Windows version on the compromised host.

HOPLIGHT has been observed collecting victim machine information like OS version.

Cuckoo Stealer can gather information about the OS version and hardware on compromised hosts.

MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.

InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.

Naid collects a unique identifier (UID) from a compromised host.

Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.

WINERACK can gather information about the host.

ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.

AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.

Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.

Okrum can collect computer name, locale information, and information about the OS and architecture.

Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.

Line Dancer can gather system configuration information by running the native `show configuration` command.

Neoichor can collect the OS version and computer name from a compromised host.

Raspberry Robin performs several system checks as part of anti-analysis mechanisms, including querying the operating system build number, processor vendor and type, video controller, and CPU temperature.

Mispadu collects the OS version, computer name, and language ID.

Diavol can collect the computer name and OS version from the system.

RustyWater has gathered the victim machine’s computer name.

BlackCat can obtain the computer name and UUID.

Fysbis has used the command ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release" to determine which Linux OS version is running.

IcedID has the ability to identify the computer name and OS version on a compromised host.