Procedure examples

SombRAT can execute getinfo to discover the current time on a compromised host.

HOPLIGHT has been observed collecting system time from victim machines.

InvisiMole gathers the local system time from the victim’s machine.

Okrum can obtain the date and time of the compromised system.

Nightdoor can identify the system local time information.

DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.

DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.

Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.

Green Lambert can collect the date and time from a compromised host.

GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.

BeaverTail has obtained and sent the current timestamp associated with the victim device to C2.

DarkWatchman can collect time zone information and system `UPTIME`.

PlugX has identified system time through its GetSystemInfo command.

Bisonal can check the system time set on the infected host.

Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.

KEYPLUG can obtain the current tick count of an infected computer.

Clambling can determine the current time.

DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.

SVCReady can collect time zone information.

SHARPSTATS has the ability to identify the current date and time on the compromised host.

LODEINFO can capture system time to send to the C2.

TAINTEDSCRIBE can execute GetLocalTime for time discovery.

BendyBear has the ability to determine local time on a compromised host.

GlassWorm has the ability to check the system’s time zone on the victim device.

Metamorfo uses JavaScript to get the system time.

PipeMon can send time zone information from a compromised host to C2.

T9000 gathers and beacons the system time during installation.

Shamoon obtains the system time and will only activate if it is greater than a preset date.

BLUELIGHT can collect the local time on a compromised host.

StoneDrill can obtain the current date and time of the victim machine.

OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.

RTM can obtain the victim time zone.

Grandoreiro can determine the time on the victim machine via IPinfo.

Bazar can collect the time on the compromised host.

MoonWind obtains the victim's current time.

ccf32 can determine the local time on targeted machines.

Zebrocy gathers the current time zone and date information from the system.

SUNBURST collected device `UPTIME`.

EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.

Taidoor can use GetLocalTime and GetSystemTime to collect system time.

TajMahal has the ability to determine local time on a compromised host.

Raccoon Stealer gathers victim machine timezone information.

Carbon uses the command net time \\127.0.0.1 to get information the system’s time.

BISCUIT has a command to collect the system `UPTIME`.

FunnyDream can check system time to help determine when changes were made to specified files.

Egregor contains functionality to query the local/system time.

FELIXROOT gathers the time zone information from the victim’s machine.

Cannon can collect the current time zone information from the victim’s machine.

build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.

ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).