Procedure examples

ZxxZ has collected the host name and operating system product name from a compromised machine.

WINDSHIELD can gather the victim computer name.

Shark can collect the GUID of a targeted machine.

Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.

Kobalos can record the hostname and kernel version of the target machine.

BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.

RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.

XLoader can collect system information and supported language information from the victim machine.

SOUNDBITE is capable of gathering system information.

BADCALL collects the computer name and host name on the compromised system.

MoonWind can obtain the victim hostname, Windows version, RAM amount, and screen resolution.

HiddenFace can enumerate the hostname and username of the compromised system.

HermeticWiper can determine the OS version and bitness on a targeted host.

Final1stspy obtains victim Microsoft Windows version information and CPU architecture.

Kapeka utilizes WinAPI calls and registry queries to gather system information.

LockBit 2.0 can enumerate system information including hostname and domain information.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

FinFisher checks if the victim OS is 32 or 64-bit.

SpeakUp uses the cat /proc/cpuinfo | grep -c “cpu family” 2>&1 command to gather system information.

LunarMail can capture environmental variables on compromised hosts.

Cadelspy has the ability to discover information about the compromised host.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s computer name.

SUNBURST collected hostname and OS version.

Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.

HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.

ServHelper will attempt to enumerate Windows version and system architecture.

Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.

REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.

Valak can determine the Windows version and computer name on a compromised host.

PinchDuke gathers system configuration information.

Milan can enumerate the targeted machine's name and GUID.

OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the ioreg command to gather some of this information.

OilBooster can identify the compromised system's hostname which is used to create a unique identifier.

CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.

Cyclops Blink has the ability to query device information.

TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.

Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.

Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.

BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.

Solar can send basic information about the infected host to C2.

Pisloader has a command to collect victim system information, including the system name and OS version.

GoldenSpy has gathered operating system information.

Gold Dragon collects endpoint information using the systeminfo command.

The AshTag loader and AshenOrchestrator components can collect reconnaissance data from victim machines.

Carberp has collected the operating system version from the infected system.

NKAbuse conducts multiple system checks and includes these in subsequent "heartbeat" messages to the malware's command and control server.

Revenge RAT collects the CPU information, OS information, and system language.

MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.

More_eggs has the capability to gather the OS version and computer name.

SysUpdate can collect a system's architecture, operating system version, and hostname.