Procedure examples

VERMIN collects the OS name, machine name, and architecture information.

Nightdoor gathers information on the victim system such as CPU and Computer name as well as device drivers.

MarkiRAT can obtain the computer name from a compromised host.

PowerShower has collected system information on the infected host.

Kazuar gathers information on the system.

NavRAT uses systeminfo on a victim’s machine.

DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.

POORAIM can identify system information, including battery status.

FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.

Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.

BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.

zwShell can obtain the victim PC name and OS version.

Rising Sun can detect the computer name and operating system.

Chrommme has the ability to obtain the computer name of a compromised host.

ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.

SocGholish has the ability to enumerate system information including the victim computer name.

SpicyOmelette can identify the system name of a compromised host.

XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.

Green Lambert can use `uname` to identify the operating system name, version, and processor type.

LightSpy's second stage implant uses the `DeviceInformation` class to collect system information, including CPU usage, battery statistics, memory allocations, screen size, etc.

PUNCHBUGGY can gather system information such as computer names.

KeyBoy can gather extended system information, such as information about the operating system and memory.

MiniDuke can gather the hostname on a compromised machine.

Anchor can determine the hostname and linux version on a compromised host.

DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.

BeaverTail has been known to collect basic system information. BeaverTail has also collected data to include hostname and current timestamp prior to uploading data to the API endpoint `/uploads` on the C2 server.

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.

CORESHELL collects hostname and OS version data from the victim and sends the information to its C2 server.

RunningRAT gathers the OS version and processor information.

DarkWatchman can collect the OS version, system architecture, and computer name.

Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.

PlugX has collected system information including OS version, processor information, RAM size, location, host name, IP, and screen size of the infected host.

Reaver collects system information from the victim, including CPU speed, computer name, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.

Bisonal has used commands and API calls to gather system information.

NOOPLDR can discover the device ID and hostname from the targeted machine to use for encryption keys.

The initial beacon packet for S-Type contains the operating system version and file system of the victim.

Lumma Stealer has gathered various system information from victim machines.

DustySky extracts basic information about the operating system.

Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.

Explosive has collected the computer name from the infected host.

Epic collects the OS version, hardware information, computer name, available system memory status, and system and user language settings.

LightNeuron gathers the victim computer name using the Win32 API call GetComputerName.

Clambling can discover the hostname, computer name, and Windows version of a targeted machine.

PureCrypter can enumerate a targeted system's SerialNumber and Version.

Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.

DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.

Mongall can retrieve the hostname via `gethostbyname`.

NanHaiShu can gather the victim computer name and serial number.

LockBit 3.0 can enumerate system hostname and domain.

SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.