Procedure examples

ADVSTORESHELL can list connected devices.

DOGCALL can capture microphone data from the victim's machine.

Janicab captured audio and sent it out to a C2 server.

EvilGrab has the capability to capture audio from a victim machine.

Crimson can perform audio surveillance using microphones.

Machete captures audio from the computer’s microphone.

InvisiMole can record sound using input audio devices.

VERMIN can perform audio capture.

DarkComet can listen in to victims' conversations through the system’s microphone.

LightSpy uses Apple's built-in AVFoundation Framework library to capture and manage audio recordings then transform them to JSON blobs for exfiltration.

ROKRAT has an audio capture and eavesdropping module.

Bandook has modules that are capable of capturing audio.

T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.

Micropsia can perform microphone recording.

Attor's has a plugin that is capable of recording audio using available input sound devices.

NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.

Derusbi is capable of performing audio captures.

MgBot can capture input and output audio streams from infected devices.

Cadelspy has the ability to record audio from the compromised host.

Cobian RAT has a feature to perform voice recording on the victim’s machine.

NanoCore can capture audio feeds from the system.

TajMahal has the ability to capture VoiceIP application audio on an infected host.

Revenge RAT has a plugin for microphone interception.

MacMa has the ability to record audio.

jRAT can capture microphone recordings.

MacSpy can record the sounds from microphones on a computer.

PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.

Remcos can capture data from the system’s microphone.

Imminent Monitor has a remote microphone monitoring capability.

Pupy can record sound with the microphone.

Flame can record audio using any existing hardware recording devices.

PowerDuke has commands to get the time the machine was built, the time, and the time zone.

GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.

As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.

Torisma can collect the current time on a victim machine.

NOKKI can collect the current timestamp of the victim's machine.

Stuxnet collects the time and date of a system when it is infected.

AvosLocker has checked the system time before and after encryption.

PAKLOG has collected a timestamp to log the precise time a key was pressed, formatted as %Y-%m-%d %H:%M:%S.

WindTail has the ability to generate the current date and time.

Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.

GravityRAT can obtain the date and time of a system.

Medusa Ransomware has discovered device uptime through `GetTickCount()`.

AppleSeed can pull a timestamp from the victim's machine.

Crimson has the ability to determine the date and time on a compromised host.

DUSTTRAP reads the infected system's current time and writes it to a log file during execution.

BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.

PUBLOAD has collected the machine’s tick count through the use of `GetTickCount`.

SystemBC has leveraged the time of the device to create a text file with a filename that uses the function of `uniqid(time()).‘.txt`, consisting of the 10 character UNIX timestamp and 13 hexadecimal characters.

ShrinkLocker retrieves a system timestamp that is used in generating an encryption key.