Procedure examples

Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.

Pasam creates a backdoor through which remote attackers can retrieve information like hostname.

POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.

Linfo creates a backdoor through which remote attackers can retrieve system information.

ShadowPad has discovered system information including memory status, CPU frequency, and OS versions.

Astaroth collects the machine name and keyboard language from the system.

QakBot can collect system information including the OS version and domain on a compromised host.

SYSCON has the ability to use Systeminfo to identify system information.

Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.

jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.

Dridex has collected the computer name and OS architecture information from the system.

OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command sw_vers -productVersion.

Denis collects OS information and the computer name from the victim’s machine.

SplatCloak has collected the Windows build number using the windows kernel API `RtlGetVersion` to determine if the response is 19000 or higher (Windows 10 version 2004 or later).

Comnie collects the hostname of the victim machine.

OSInfo discovers information about the infected machine.

Lizar can collect the computer name from the machine.

Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.

LoudMiner has monitored CPU usage.

Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.

During its initial execution, BACKSPACE extracts operating system information from the infected host.

UPPERCUT has the capability to gather the system’s hostname and OS version.

ADVSTORESHELL can run Systeminfo to gather information about the victim.

StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.

WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.

SLOTHFULMEDIA has collected system name, OS version, adapter information, and memory usage from a victim machine.

FALLCHILL can collect operating system (OS) version information, processor information, and system name from the victim.

XORIndex Loader has the ability to collect the hostname, OS Username, Geolocation, and OS version of an infected host.

Covenant implants can gather basic information on infected systems.

Diskpart can show information about the selected disk, partition, volume, or virtual hard disk (VHD).

ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.

SILENTTRINITY can collect information related to a compromised host, including OS version.

Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.

dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.

PoshC2 contains modules, such as Get-ComputerInfo, for enumerating common system information.

Remcos can collect the OS version and process architecture of compromised hosts.

Systeminfo can be used to gather information about the operating system.

cmd can be used to find information about the operating system.

Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.

Pupy can grab a system’s information including the OS version, architecture, etc.

QuasarRAT can gather system information from the victim’s machine including the OS type.

TeamPCP Cloud Stealer has detected if it is on a developer machine by checking if the environmental variable  GITHUB_ACTIONS != “true”. TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using `hostname` and `uname-a`.

Mini Shai-Hulud has gathered system information of victim hosts through the use of common discovery commands to include `hostname`, `uname-a` and `printenv`. Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.

BADFLICK has captured victim computer name, memory space, and CPU details.

TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.

PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.

BLINDINGCAN can search, read, write, move, and execute files.

Ninja has the ability to enumerate directory content.

QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.

SynAck checks its directory location in an attempt to avoid launching in a sandbox.