Procedure examples

RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.

LitePower has the ability to enumerate the OS architecture.

StreamEx has the ability to enumerate system information.

SDBbot has the ability to identify the OS version, OS bit information and computer name.

RTM can obtain the computer name, OS version, and default language identifier.

Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.

BlackByte Ransomware gathers victim system information to generate a unique victim identifier.

SodaMaster can enumerate the host name and OS version on a target system.

StrelaStealer variants collect victim system information for exfiltration.

Grandoreiro can collect the computer name and OS version from a compromised host.

LiteDuke can enumerate the CPUID and BIOS version on a compromised system.

ZxxZ has collected the host name and operating system product name from a compromised machine.

WINDSHIELD can gather the victim computer name.

Shark can collect the GUID of a targeted machine.

Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.

Kobalos can record the hostname and kernel version of the target machine.

BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.

RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.

XLoader can collect system information and supported language information from the victim machine.

SOUNDBITE is capable of gathering system information.

BADCALL collects the computer name and host name on the compromised system.

MoonWind can obtain the victim hostname, Windows version, RAM amount, and screen resolution.

HiddenFace can enumerate the hostname and username of the compromised system.

HermeticWiper can determine the OS version and bitness on a targeted host.

Final1stspy obtains victim Microsoft Windows version information and CPU architecture.

Kapeka utilizes WinAPI calls and registry queries to gather system information.

LockBit 2.0 can enumerate system information including hostname and domain information.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

FinFisher checks if the victim OS is 32 or 64-bit.

SpeakUp uses the cat /proc/cpuinfo | grep -c “cpu family” 2>&1 command to gather system information.

LunarMail can capture environmental variables on compromised hosts.

Cadelspy has the ability to discover information about the compromised host.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s computer name.

SUNBURST collected hostname and OS version.

Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.

HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.

ServHelper will attempt to enumerate Windows version and system architecture.

Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.

REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.

Valak can determine the Windows version and computer name on a compromised host.

PinchDuke gathers system configuration information.

Milan can enumerate the targeted machine's name and GUID.

OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the ioreg command to gather some of this information.

OilBooster can identify the compromised system's hostname which is used to create a unique identifier.

CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.

Cyclops Blink has the ability to query device information.

TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.

Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.

Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.

BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.