Procedure examples

Octopus can collect the computer name, OS version, and OS architecture information.

Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.

AppleJeus has collected the victim host information after infection.

SoreFang can collect the hostname, operating system configuration, and product ID on victim machines by executing Systeminfo.

STARWHALE can gather the computer name of an infected host.

MirageFox can collect CPU and architecture information from the victim’s machine.

Industroyer collects the victim machine’s Windows GUID.

LazyWiper has used `[System.Net.Dns]::GetHostName()` and `$env:COMPUTERNAME` to enumerate the hostname of a system and determine if it is a domain controller.

DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.

A system info module in CozyCar gathers information on the victim host’s configuration.

Kevin can enumerate the OS version and hostname of a targeted machine.

Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.

Pasam creates a backdoor through which remote attackers can retrieve information like hostname.

POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.

Linfo creates a backdoor through which remote attackers can retrieve system information.

ShadowPad has discovered system information including memory status, CPU frequency, and OS versions.

Astaroth collects the machine name and keyboard language from the system.

QakBot can collect system information including the OS version and domain on a compromised host.

SYSCON has the ability to use Systeminfo to identify system information.

Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.

jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.

Dridex has collected the computer name and OS architecture information from the system.

OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command sw_vers -productVersion.

Denis collects OS information and the computer name from the victim’s machine.

SplatCloak has collected the Windows build number using the windows kernel API `RtlGetVersion` to determine if the response is 19000 or higher (Windows 10 version 2004 or later).

Comnie collects the hostname of the victim machine.

OSInfo discovers information about the infected machine.

Lizar can collect the computer name from the machine.

Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.

LoudMiner has monitored CPU usage.

Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.

During its initial execution, BACKSPACE extracts operating system information from the infected host.

UPPERCUT has the capability to gather the system’s hostname and OS version.

ADVSTORESHELL can run Systeminfo to gather information about the victim.

StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.

WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.

SLOTHFULMEDIA has collected system name, OS version, adapter information, and memory usage from a victim machine.

FALLCHILL can collect operating system (OS) version information, processor information, and system name from the victim.

XORIndex Loader has the ability to collect the hostname, OS Username, Geolocation, and OS version of an infected host.

Covenant implants can gather basic information on infected systems.

Diskpart can show information about the selected disk, partition, volume, or virtual hard disk (VHD).

ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.

SILENTTRINITY can collect information related to a compromised host, including OS version.

Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.

dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.

PoshC2 contains modules, such as Get-ComputerInfo, for enumerating common system information.

Remcos can collect the OS version and process architecture of compromised hosts.

Systeminfo can be used to gather information about the operating system.

cmd can be used to find information about the operating system.

Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.