Procedure examples

XORIndex Loader can identify the geographical location of a victim host.

Remcos can identify the location of targeted devices.

QuasarRAT can determine the country a victim host is located in.

Mini Shai-Hulud has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.

Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word “Arabic” before executing.

SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.

SharpStage has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.

Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.

Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.

PUBLOAD has checked supported languages on the compromised system.

Gootloader can determine if a victim's computer is running an operating system with specific language preferences.

DropBook has checked for the presence of Arabic language in the infected machine's settings.

Cuckoo Stealer can check the systems `LANG` environmental variable to prevent infecting devices from Armenia (`hy_AM`), Belarus (`be_BY`), Kazakhstan (`kk_KZ`), Russia (`ru_RU`), and Ukraine (`uk_UA`).

Neoichor can identify the system language on a compromised host.

Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.

IcedID used the following command to check the country/language of the active console:
` cmd.exe /c chcp >&2`.

MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.

Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.

Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.

S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.

Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.

Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.

LockBit 3.0 will not affect machines with language settings matching a defined exlusion list of mainly Eastern European languages.

LODEINFO can looks for the “en_US” locale on the victim’s machine.

GlassWorm has identified the system language settings by checking for `ru_RU`, `ru-RU`, `ru`, and `Russian` to prevent execution in a Russian associated device.

RedLine Stealer can retrieve system default language and time zone.

BlackByte Ransomware identifies the language on the victim system.

StrelaStealer variants check system language settings via keyboard layout or similar mechanisms.

Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.

Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage. If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.

LockBit 2.0 can check if a targeted machine is using a set of Eastern European languages and exit without infection if so.

REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage. If the language is found in the list, the process terminates.

GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.

Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.

StealBit can determine system location based on the default language setting and will not execute on systems located in former Soviet countries.

Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.

XCSSET uses AppleScript to check the host's language and location with the command user locale of (get system info).

Mini Shai-Hulud has the ability to check system details for its language configuration and terminates actions when the system is configured for the Russian language.

CanisterWorm has checked the target system's timezone `(/etc/timezone, timedatectl)` for `Asia/Tehran` or `Iran` and the `LANG` environment variable for `fa_IR` to identify systems matching an Iranian locale prior to deploying its destructive wiper component.

Emissary has the capability to execute gpresult.

DUSTTRAP can identify victim environment Group Policy information.

LunarWeb can capture information on group policy settings

BloodHound has the ability to collect local admin information via GPO.

Empire includes various modules for enumerating Group Policy.

Pacu can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.

TruffleHog can enumerate cloud storage environments including Amazon Web Service (AWS) S3 buckets and Google Cloud Storage buckets.

Peirates can list AWS S3 buckets.

Pikabot reflectively loads stored, previously encrypted components of the PE file into memory of the currently executing process to avoid writing content to disk on the executing machine.

Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.

Emotet has reflectively loaded payloads into memory.