Procedure examples

Agent Tesla can collect the timestamp from the victim’s machine.

StarProxy has utilized the windows API call `GetLocalTime()` to retrieve a SystemTime structure to generate a seed value.

ShadowPad has collected the current date and time of the victim system.

Astaroth collects the timestamp from the infected machine.

QakBot can identify the system time on a targeted host.

DEADWOOD will set a timestamp value to determine when wiping functionality starts. When the timestamp is met on the system, a trigger file is created on the operating system allowing for execution to proceed. If the timestamp is in the past, the wiper will execute immediately.

Azorult can collect the time zone information from the system.

UPPERCUT has the capability to obtain the time zone information and the current timestamp of the victim’s machine.

StrifeWater can collect the time zone from the victim's machine.

The net time command can be used in Net to determine the local or remote system time.

SILENTTRINITY can collect start time information from a compromised host.

AsyncRAT can check whether the current system hour and day of the week are within operating hours defined it its configuration.

Mini Shai-Hulud has queried the system timezone configuration and timezone data files to include `/etc/localtime`, and locale settings to determine the geolocation of the compromised host.

CanisterWorm has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”

EvilGrab has the capability to capture video from a victim machine.

Crimson can capture webcam video on targeted systems.

Machete takes photos from the computer’s web camera.

InvisiMole can remotely activate the victim’s webcam to capture content.

Kazuar captures images from the webcam.

DarkComet can access the victim’s webcam to take pictures.

ObliqueRAT can capture images from webcams on compromised hosts.

Clambling can record screen content in AVI format.

Bandook has modules that are capable of capturing video from a victim's webcam.

T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.

SDBbot has the ability to record video on a compromised host.

Derusbi is capable of capturing video.

Cobian RAT has a feature to access the webcam on the victim’s machine.

NanoCore can access the victim's webcam and capture data.

TajMahal has the ability to capture webcam video.

Revenge RAT has the ability to access the webcam.

PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.

ZxShell has a command to perform video device spying.

njRAT can access the victim's webcam.

Agent Tesla can access the victim’s webcam and record video.

jRAT has the capability to capture video from a webcam.

WarzoneRAT can access the webcam on a victim's machine.

Empire can capture webcam data on Windows and macOS systems.

PcShare can capture camera video as part of its collection process.

AsyncRAT can record screen content on targeted systems.

Remcos can access a system’s webcam and take pictures.

ConnectWise can record video on remote hosts.

Imminent Monitor has a remote webcam monitoring capability.

Pupy can access a connected webcam and capture pictures.

QuasarRAT can perform webcam viewing.

Quick Assist allows for the remote administrator to view the interactive session of the running machine, including full screen activity.

A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.

NOOPLDR can be executed via MSBuild.

Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.

Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.