Procedure examples

Solar can send basic information about the infected host to C2.

Pisloader has a command to collect victim system information, including the system name and OS version.

GoldenSpy has gathered operating system information.

Gold Dragon collects endpoint information using the systeminfo command.

The AshTag loader and AshenOrchestrator components can collect reconnaissance data from victim machines.

Carberp has collected the operating system version from the infected system.

NKAbuse conducts multiple system checks and includes these in subsequent "heartbeat" messages to the malware's command and control server.

Revenge RAT collects the CPU information, OS information, and system language.

MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.

More_eggs has the capability to gather the OS version and computer name.

SysUpdate can collect a system's architecture, operating system version, and hostname.

BackConfig has the ability to gather the victim's computer name.

Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.

BoomBox can enumerate the hostname, domain, and IP of a compromised host.

DEADEYE can enumerate a victim computer's volume serial number and host name.

LAMEHUG has the ability to execute Windows commands returned from C2 to gather system information.

Mango can collect the machine name of a compromised system which is later used as part of a unique victim identifier.

InnaputRAT gathers system information.

Kessel has collected the system architecture, OS version, and MAC address information.

GrimAgent can collect the OS, and build version on a compromised host.

YAHOYAH checks for the system’s Windows OS version and hostname.

Lokibot has the ability to discover the computer name and Windows product name/version.

Egregor can perform a language check of the infected system and can query the CPU information (cupid).

PoetRAT has the ability to gather information about the compromised host.

StealBit can enumerate the computer name and domain membership of the compromised system.

FELIXROOT collects the victim’s computer name, processor architecture, OS version, and system type.

ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.

RIFLESPINE can collect system information after installation on infected systems.

NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.

Penquin can report the file system type of a compromised host to C2.

SPAWNCHIMERA has obtained system information such as release, uptime, and current time.

BabyShark has executed the ver command.

Cannon can gather system information from the victim’s machine such as the OS version, and machine name.

Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.

Troll Stealer can collect local system information.

Meteor has the ability to discover the hostname of a compromised host.

njRAT enumerates the victim operating system and computer name during the initial infection.

Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.

TURNEDUP is capable of gathering system information.

ChChes collects the victim hostname, window resolution, and Microsoft Windows version.

Manjusaka performs basic system profiling actions to fingerprint and register the victim system with the C2 controller.

The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.

Shai-Hulud has gathered victim system information.

JPIN can obtain system information such as OS version and disk space.

metaMain can collect the computer name from a compromised host.

SideTwist can collect the computer name of a targeted system.

KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.

The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.

LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.

XCSSET identifies the macOS version and uses ioreg to determine serial number.