Procedure examples

Okrum can collect computer name, locale information, and information about the OS and architecture.

Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.

Line Dancer can gather system configuration information by running the native `show configuration` command.

Neoichor can collect the OS version and computer name from a compromised host.

Raspberry Robin performs several system checks as part of anti-analysis mechanisms, including querying the operating system build number, processor vendor and type, video controller, and CPU temperature.

Mispadu collects the OS version, computer name, and language ID.

Diavol can collect the computer name and OS version from the system.

RustyWater has gathered the victim machine’s computer name.

BlackCat can obtain the computer name and UUID.

Fysbis has used the command ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release" to determine which Linux OS version is running.

IcedID has the ability to identify the computer name and OS version on a compromised host.

VERMIN collects the OS name, machine name, and architecture information.

Nightdoor gathers information on the victim system such as CPU and Computer name as well as device drivers.

MarkiRAT can obtain the computer name from a compromised host.

PowerShower has collected system information on the infected host.

Kazuar gathers information on the system.

NavRAT uses systeminfo on a victim’s machine.

DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.

POORAIM can identify system information, including battery status.

FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.

Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.

BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.

zwShell can obtain the victim PC name and OS version.

Rising Sun can detect the computer name and operating system.

Chrommme has the ability to obtain the computer name of a compromised host.

ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.

SocGholish has the ability to enumerate system information including the victim computer name.

SpicyOmelette can identify the system name of a compromised host.

XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.

Green Lambert can use `uname` to identify the operating system name, version, and processor type.

LightSpy's second stage implant uses the `DeviceInformation` class to collect system information, including CPU usage, battery statistics, memory allocations, screen size, etc.

PUNCHBUGGY can gather system information such as computer names.

KeyBoy can gather extended system information, such as information about the operating system and memory.

MiniDuke can gather the hostname on a compromised machine.

Anchor can determine the hostname and linux version on a compromised host.

DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.

BeaverTail has been known to collect basic system information. BeaverTail has also collected data to include hostname and current timestamp prior to uploading data to the API endpoint `/uploads` on the C2 server.

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.

CORESHELL collects hostname and OS version data from the victim and sends the information to its C2 server.

RunningRAT gathers the OS version and processor information.

DarkWatchman can collect the OS version, system architecture, and computer name.

Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.

PlugX has collected system information including OS version, processor information, RAM size, location, host name, IP, and screen size of the infected host.

Reaver collects system information from the victim, including CPU speed, computer name, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.

Bisonal has used commands and API calls to gather system information.

NOOPLDR can discover the device ID and hostname from the targeted machine to use for encryption keys.

The initial beacon packet for S-Type contains the operating system version and file system of the victim.

Lumma Stealer has gathered various system information from victim machines.

DustySky extracts basic information about the operating system.

Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.