Procedure examples

DarkGate uses the Delphi methods Sysutils::DiskSize and GlobalMemoryStatusEx to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.

Mongall can identify drives on compromised hosts.

LockBit 3.0 can enumerate local drive configuration.

TYPEFRAME can gather the disk volume information.

TAINTEDSCRIBE can use DriveList to retrieve drive information.

Royal can use `GetLogicalDrives` to enumerate logical drives.

Bandook can collect information about the drives available on the system.

KONNI can gather information on connected drives and disk space from the victim’s machine.

JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.

KGH_SPY can collect drive information from a compromised host.

down_new has the ability to identify the system volume information of a compromised host.

Black Basta can enumerate volumes.

Attor monitors the free disk space on the system.

LitePower has the ability to list local drives.

Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.

HermeticWiper can enumerate physical drives on a targeted host.

LockBit 2.0 can enumerate local drive configuration.

Zebrocy collects the serial number for the storage volume C:\.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s volume ID.

REvil can identify system drive information on a compromised host.

Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.

AshTag can use `volumeserialnumber` to enumerate volumes.

MacMa can collect information about a compromised computer's disk sizes.

FunnyDream can enumerate all logical drives on a targeted machine.

ROADSWEEP can enumerate logical drives on targeted devices.

SysUpdate can collect a system's drive information.

InnaputRAT gathers volume drive information.

FELIXROOT collects the victim’s volume serial number.

Penquin can report the disk space of a compromised host to C2.

Cannon can gather drive information from the victim's machine.

build_downer has the ability to send system volume information to C2.

Heyoka Backdoor can enumerate drives on a compromised host.

Octopus can collect system drive and disk size information.

KillDisk retrieves the hard disk name by calling the CreateFileA to \\.\PHYSICALDRIVE0 API.

Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.

SoreFang can collect disk space information on victim machines by executing Systeminfo.

Pasam creates a backdoor through which remote attackers can retrieve information like free disk space.

ShadowPad has discovered system information including volume serial numbers.

INC Ransomware can discover and mount hidden drives to encrypt them.

Zox can enumerate attached drives.

SLOTHFULMEDIA has collected disk information from a victim machine.

FALLCHILL can collect information about installed disks from the victim.

SILENTTRINITY can collect information related to a compromised host, including a list of drives.

AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`

CrackMapExec can enumerate the system drives and associated system name.

ZeroCleare can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.

Kali365 has generated tailored branded phishing lures to target victims utilizing a myriad of reputable services and brands that entice users to interact with the content. Kali365 has also been enabled with AI such as Claude Sonnet that evaluates emails and generates tailored responses to facilitate BEC activities.

RustyWater has impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain `info@tmcell`.

NPPSPY creates a network listener using the misspelled label logincontroll recorded to the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order.

HDoor kills anti-virus found on the victim.