Procedure examples

RTM can obtain the victim time zone.

Grandoreiro can determine the time on the victim machine via IPinfo.

Bazar can collect the time on the compromised host.

MoonWind obtains the victim's current time.

ccf32 can determine the local time on targeted machines.

Zebrocy gathers the current time zone and date information from the system.

SUNBURST collected device `UPTIME`.

EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.

Taidoor can use GetLocalTime and GetSystemTime to collect system time.

TajMahal has the ability to determine local time on a compromised host.

Raccoon Stealer gathers victim machine timezone information.

Carbon uses the command net time \\127.0.0.1 to get information the system’s time.

BISCUIT has a command to collect the system `UPTIME`.

FunnyDream can check system time to help determine when changes were made to specified files.

Egregor contains functionality to query the local/system time.

FELIXROOT gathers the time zone information from the victim’s machine.

Cannon can collect the current time zone information from the victim’s machine.

build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.

ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).

Agent Tesla can collect the timestamp from the victim’s machine.

StarProxy has utilized the windows API call `GetLocalTime()` to retrieve a SystemTime structure to generate a seed value.

ShadowPad has collected the current date and time of the victim system.

Astaroth collects the timestamp from the infected machine.

QakBot can identify the system time on a targeted host.

DEADWOOD will set a timestamp value to determine when wiping functionality starts. When the timestamp is met on the system, a trigger file is created on the operating system allowing for execution to proceed. If the timestamp is in the past, the wiper will execute immediately.

Azorult can collect the time zone information from the system.

UPPERCUT has the capability to obtain the time zone information and the current timestamp of the victim’s machine.

StrifeWater can collect the time zone from the victim's machine.

The net time command can be used in Net to determine the local or remote system time.

SILENTTRINITY can collect start time information from a compromised host.

AsyncRAT can check whether the current system hour and day of the week are within operating hours defined it its configuration.

Mini Shai-Hulud has queried the system timezone configuration and timezone data files to include `/etc/localtime`, and locale settings to determine the geolocation of the compromised host.

CanisterWorm has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”