Procedure examples

Orz can gather the victim's Internet Explorer version.

IronWind can list installed software on targeted hosts.

InvisibleFerret has gathered installed programs and running processes.

PUBLOAD has used several commands executed in sequence via `cmd` in a short interval to gather software versions including querying Registry keys.

Woody RAT can collect .NET, PowerShell, and Python information from an infected host.

Cuckoo Stealer has the ability to search systems for installed applications.

InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

P.A.S. Webshell can list PHP server configuration details.

Siloscape searches for the kubectl binary.

MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.

SocGholish can identify the victim's browser in order to serve the correct fake update page.

SpicyOmelette can enumerate running software on a targeted system.

If sent the command `16001`, LightSpy uses the `NSFileManger contentsOfDirectoryAtPath()` to enumerate the Applications folder to collect the bundle name, bundle identifier, and version information from each application's `info.plist` file. The results are then converted into a JSON blob for exfiltration.

Dyre has the ability to identify installed programs on a compromised host.

DustySky lists all installed software for the infected machine.

SVCReady can collect a list of installed software from an infected host.

CharmPower can list the installed applications on a compromised host.

Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.

GlassWorm has searched for existing wallet applications to include Ledger Live and Trezor Suite.

Metamorfo has searched the compromised system for banking applications.

KGH_SPY can collect information on installed applications.

down_new has the ability to gather information on installed applications.

RedLine Stealer can get a list of programs on the victim device.

RTM can scan victim drives to look for specific banking software on the machine to determine next actions.

StrelaStealer variants use COM objects to enumerate installed applications from the "AppsFolder" on victim machines.

Bazar can query the Registry for installed applications.

SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.

The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.

HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

Samurai can check for the presence and version of the .NET framework.

TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.

Raccoon Stealer is capable of identifying running software on victim machines.

ComRAT can check the victim's default browser to determine which process to inject its communications module into.

LunarWeb can list installed software on compromised systems.

XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.

QakBot can enumerate a list of installed programs.

Dridex has collected a list of installed software on the system.

ShimRatReporter gathered a list of installed software on the infected host.

TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.