Procedure examples

Explosive has collected the computer name from the infected host.

Epic collects the OS version, hardware information, computer name, available system memory status, and system and user language settings.

LightNeuron gathers the victim computer name using the Win32 API call GetComputerName.

Clambling can discover the hostname, computer name, and Windows version of a targeted machine.

PureCrypter can enumerate a targeted system's SerialNumber and Version.

Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.

DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.

Mongall can retrieve the hostname via `gethostbyname`.

NanHaiShu can gather the victim computer name and serial number.

LockBit 3.0 can enumerate system hostname and domain.

SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.

Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.

SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.

Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.

Caterpillar WebShell has a module to gather information from the compromised asset, including the computer version, computer name, IIS version, and more.

Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.

Elise executes systeminfo after initial communication is made to the remote server.

Latrodectus can gather operating system information.

Saint Bot can identify the OS version, CPU, and other details from a victim's machine.

Pay2Key has the ability to gather the hostname of the victim machine.

Chaes has collected system information, including the machine name and OS version.

LODEINFO can disover machine information including OS architecture, the ANSI code page (ACP) identifier, and hostname.

CharmPower can enumerate the OS version and computer name on a targeted system.

Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.

EVILNUM can obtain the computer name from the victim's system.

KOMPROGO is capable of retrieving information about the infected system.

SMOKEDHAM has used the systeminfo command on a compromised host.

Sagerunex gathers information from the infected system such as hostname.

Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.

Royal can use `GetNativeSystemInfo` to enumerate system processors.

GlassWorm has the ability to check the OS of the victim host. GlassWorm has checked whether the OS platform value includes `darwin` prior to execution of macOS specific scripts.

Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.

Metamorfo has collected the hostname and operating system version from the compromised host.

Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.

PipeMon can collect and send OS version and computer name as a part of its C2 beacon.

MagicRAT collects basic system information from victim machines.

KONNI can gather the OS version, architecture information, hostname, and RAM size information from the victim’s machine and has used cmd /c systeminfo command to get a snapshot of the current system state of the target machine.

T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.

gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.

Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.

MoleNet can collect information about the about the system.

BLUELIGHT has collected the computer name and OS version from victim machines.

Ixeshe collects the computer name of the victim's system during the initial infection.

Micropsia gathers the hostname and OS version from the victim’s machine.

Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.

RedLine Stealer can collect information about the local system.

Black Basta can collect system boot configuration and CPU information.

StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.

OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.

4H RAT sends an OS version identifier in its beacons.