Procedure examples

InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

P.A.S. Webshell can list PHP server configuration details.

Siloscape searches for the kubectl binary.

MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.

SocGholish can identify the victim's browser in order to serve the correct fake update page.

SpicyOmelette can enumerate running software on a targeted system.

If sent the command `16001`, LightSpy uses the `NSFileManger contentsOfDirectoryAtPath()` to enumerate the Applications folder to collect the bundle name, bundle identifier, and version information from each application's `info.plist` file. The results are then converted into a JSON blob for exfiltration.

Dyre has the ability to identify installed programs on a compromised host.

DustySky lists all installed software for the infected machine.

SVCReady can collect a list of installed software from an infected host.

CharmPower can list the installed applications on a compromised host.

Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.

GlassWorm has searched for existing wallet applications to include Ledger Live and Trezor Suite.

Metamorfo has searched the compromised system for banking applications.

KGH_SPY can collect information on installed applications.

down_new has the ability to gather information on installed applications.

RedLine Stealer can get a list of programs on the victim device.

RTM can scan victim drives to look for specific banking software on the machine to determine next actions.

StrelaStealer variants use COM objects to enumerate installed applications from the "AppsFolder" on victim machines.

Bazar can query the Registry for installed applications.

SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.

The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.

HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

Samurai can check for the presence and version of the .NET framework.

TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.

Raccoon Stealer is capable of identifying running software on victim machines.

ComRAT can check the victim's default browser to determine which process to inject its communications module into.

LunarWeb can list installed software on compromised systems.

XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.

QakBot can enumerate a list of installed programs.

Dridex has collected a list of installed software on the system.

ShimRatReporter gathered a list of installed software on the infected host.

TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.

Bumblebee can identify specific analytical tools based on running processes.

Amadey has checked for a variety of antivirus products.

Stuxnet enumerates the currently running processes related to a variety of security products.

POWRUNER may collect information on the victim's anti-virus software.

TAMECAT has used Windows Management Instrumentation (WMI) to check for anti-virus products.

Felismus checks for processes associated with anti-virus vendors.

Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.

StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.

xCaon has checked for the existence of Kaspersky antivirus software on the system.

ROAMINGHOUSE can identify McAfee applications on compromised hosts and change its execution method if one is detected.

TONESHELL has checked for the presence of ESET antivirus applications `ekrn.exe` and `egui.exe`.

Kasidet has the ability to identify any anti-virus installed on the infected system.

Medusa Ransomware has the capability to detect security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Crimson contains a command to collect information about anti-virus software on the victim.

DUSTTRAP can identify security software.

Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.

Avenger has the ability to identify installed anti-virus products on a compromised host.