Procedure examples

BackConfig has the ability to gather the victim's computer name.

Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.

BoomBox can enumerate the hostname, domain, and IP of a compromised host.

DEADEYE can enumerate a victim computer's volume serial number and host name.

LAMEHUG has the ability to execute Windows commands returned from C2 to gather system information.

Mango can collect the machine name of a compromised system which is later used as part of a unique victim identifier.

InnaputRAT gathers system information.

Kessel has collected the system architecture, OS version, and MAC address information.

GrimAgent can collect the OS, and build version on a compromised host.

YAHOYAH checks for the system’s Windows OS version and hostname.

Lokibot has the ability to discover the computer name and Windows product name/version.

Egregor can perform a language check of the infected system and can query the CPU information (cupid).

PoetRAT has the ability to gather information about the compromised host.

StealBit can enumerate the computer name and domain membership of the compromised system.

FELIXROOT collects the victim’s computer name, processor architecture, OS version, and system type.

ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.

RIFLESPINE can collect system information after installation on infected systems.

NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.

Penquin can report the file system type of a compromised host to C2.

SPAWNCHIMERA has obtained system information such as release, uptime, and current time.

BabyShark has executed the ver command.

Cannon can gather system information from the victim’s machine such as the OS version, and machine name.

Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.

Troll Stealer can collect local system information.

Meteor has the ability to discover the hostname of a compromised host.

njRAT enumerates the victim operating system and computer name during the initial infection.

Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.

TURNEDUP is capable of gathering system information.

ChChes collects the victim hostname, window resolution, and Microsoft Windows version.

Manjusaka performs basic system profiling actions to fingerprint and register the victim system with the C2 controller.

The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.

Shai-Hulud has gathered victim system information.

JPIN can obtain system information such as OS version and disk space.

metaMain can collect the computer name from a compromised host.

SideTwist can collect the computer name of a targeted system.

KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.

The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.

LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.

XCSSET identifies the macOS version and uses ioreg to determine serial number.

Octopus can collect the computer name, OS version, and OS architecture information.

Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.

AppleJeus has collected the victim host information after infection.

SoreFang can collect the hostname, operating system configuration, and product ID on victim machines by executing Systeminfo.

STARWHALE can gather the computer name of an infected host.

MirageFox can collect CPU and architecture information from the victim’s machine.

Industroyer collects the victim machine’s Windows GUID.

LazyWiper has used `[System.Net.Dns]::GetHostName()` and `$env:COMPUTERNAME` to enumerate the hostname of a system and determine if it is a domain controller.

DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.

A system info module in CozyCar gathers information on the victim host’s configuration.

Kevin can enumerate the OS version and hostname of a targeted machine.