Procedure examples

Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.

SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.

Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.

Caterpillar WebShell has a module to gather information from the compromised asset, including the computer version, computer name, IIS version, and more.

Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.

Elise executes systeminfo after initial communication is made to the remote server.

Latrodectus can gather operating system information.

Saint Bot can identify the OS version, CPU, and other details from a victim's machine.

Pay2Key has the ability to gather the hostname of the victim machine.

Chaes has collected system information, including the machine name and OS version.

LODEINFO can disover machine information including OS architecture, the ANSI code page (ACP) identifier, and hostname.

CharmPower can enumerate the OS version and computer name on a targeted system.

Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.

EVILNUM can obtain the computer name from the victim's system.

KOMPROGO is capable of retrieving information about the infected system.

SMOKEDHAM has used the systeminfo command on a compromised host.

Sagerunex gathers information from the infected system such as hostname.

Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.

Royal can use `GetNativeSystemInfo` to enumerate system processors.

GlassWorm has the ability to check the OS of the victim host. GlassWorm has checked whether the OS platform value includes `darwin` prior to execution of macOS specific scripts.

Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.

Metamorfo has collected the hostname and operating system version from the compromised host.

Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.

PipeMon can collect and send OS version and computer name as a part of its C2 beacon.

MagicRAT collects basic system information from victim machines.

KONNI can gather the OS version, architecture information, hostname, and RAM size information from the victim’s machine and has used cmd /c systeminfo command to get a snapshot of the current system state of the target machine.

T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.

gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.

Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.

MoleNet can collect information about the about the system.

BLUELIGHT has collected the computer name and OS version from victim machines.

Ixeshe collects the computer name of the victim's system during the initial infection.

Micropsia gathers the hostname and OS version from the victim’s machine.

Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.

RedLine Stealer can collect information about the local system.

Black Basta can collect system boot configuration and CPU information.

StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.

OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.

4H RAT sends an OS version identifier in its beacons.

RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.

LitePower has the ability to enumerate the OS architecture.

StreamEx has the ability to enumerate system information.

SDBbot has the ability to identify the OS version, OS bit information and computer name.

RTM can obtain the computer name, OS version, and default language identifier.

Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.

BlackByte Ransomware gathers victim system information to generate a unique victim identifier.

SodaMaster can enumerate the host name and OS version on a target system.

StrelaStealer variants collect victim system information for exfiltration.

Grandoreiro can collect the computer name and OS version from a compromised host.

LiteDuke can enumerate the CPUID and BIOS version on a compromised system.