Procedure examples

OceanSalt can collect the computer name from the system.

Brave Prince collects hard drive content and system configuration information.

Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.

AppleSeed can identify the OS version of a targeted system.

macOS.OSAMiner can gather the device serial number.

NETWIRE can discover and collect victim system information.

EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.

SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.

IMAPLoader uses WMI queries to gather information about the victim machine.

Gomir collects information on infected systems such as hostname, username, CPU, and RAM information.

Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, and machine GUID on a compromised host.

BOLDMOVE performs system survey actions following initial execution.

Crimson contains a command to collect the victim PC name and operating system.

DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.

Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.

BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.

Machete collects the hostname of the target computer.

Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.

Avenger has the ability to identify the OS architecture on a compromised host.

A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.

PUBLOAD has collected and sent system information including volume serial number, computer name, and system uptime to designated C2. PUBLOAD has also used several commands executed in sequence via `cmd` in a short interval to gather system information about the infected host including `systeminfo`. PUBLOAD has decrypted shellcode that collects the computer name.

SystemBC has collected username , build number and serial number, then sent the information to the C2 server. SystemBC has also gathered device name, operating system, and processor type.

Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.

PingPull can retrieve the hostname of a compromised host.

WellMess can identify the computer name of a compromised host.

DropBook has checked for the presence of Arabic language in the infected machine's settings.

Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, and environment variables.

Mafalda can collect the computer name of a compromised host.

KARAE can collect system information.

Squirrelwaffle has gathered victim computer information and configurations.

HexEval Loader has identified the OS and MAC address of victim device through host fingerprinting scripting.

AuTo Stealer has the ability to collect the hostname and OS information from an infected host.

ShrinkLocker uses WMI queries to gather various information about the victim machine and operating system.

Hildegard has collected the host's OS, CPU, and memory information.

SLOWDRIFT collects and sends system information to its C2.

SHUTTERSPEED can collect system information.

SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.

Snip3 has the ability to query `Win32_ComputerSystem` for system information.

Rifdoor has the ability to identify the Windows version on the compromised host.

HOPLIGHT has been observed collecting victim machine information like OS version.

Cuckoo Stealer can gather information about the OS version and hardware on compromised hosts.

MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.

InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.

Naid collects a unique identifier (UID) from a compromised host.

Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.

WINERACK can gather information about the host.

ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.

AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.

Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.