Procedure examples

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.

Tsundere Botnet has checked the victim machine’s location by obtaining the culture name of the machine.

InvisibleFerret has collected the internal IP address, IP geolocation information of the infected host and sends the data to a C2 server. InvisibleFerret has also leveraged the “pay” module to obtain region name, country, city, zip code, ISP, latitude and longitude using “http://ip-api.com/json”.

Crimson can identify the geographical location of a victim host.

Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.

HexEval Loader has a function where the C2 endpoint can identify the geographical location of a victim host based on request headers, execution environment and runtime conditions.

Cuckoo Stealer can determine the geographical location of a victim host by checking the language.

SameCoin can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.

Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.

SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.

DarkWatchman can identity the OS locale of a compromised host.

PlugX has obtained the location of the victim device by leveraging `GetSystemDefaultLCID`.

PureCrypter can use `kernel32!GetGeoInfo` to determine system location.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.

GlassWorm has leveraged geofencing logic to detect whether it is operating in a Russian associated time zone to determine whether it continues to execute.

RedLine Stealer has gathered detailed information about victims’ systems, such as IP addresses, and geolocation. RedLine Stealer has also checked the IP from where it was being executed and leveraged an opensource geolocation IP-lookup service.

SDBbot can collected the country code of a compromised machine.

Raccoon Stealer collects the `Locale Name` of the infected device via `GetUserDefaultLocaleName` to determine whether the string `ru` is included, but in analyzed samples no action is taken if present.

AshTag can check geolocation on targeted systems.

GrimAgent can identify the country code on a compromised host.

XORIndex Loader can identify the geographical location of a victim host.

Remcos can identify the location of targeted devices.

QuasarRAT can determine the country a victim host is located in.

Mini Shai-Hulud has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.