Procedure examples

TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.

PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.

BLINDINGCAN has collected from a victim machine the system name, processor information, and OS version.

Ninja can obtain the computer name and information on the OS from targeted hosts.

Pikabot performs a variety of system checks and gathers system information, including commands such as whoami.

RCSession can gather system information from a compromised host.

Spark can collect the hostname, keyboard layout, and language from the system.

SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.

Bumblebee can enumerate the OS version and domain on a targeted system.

MURKYTOP has the capability to retrieve information about the OS.

GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .

Amadey has collected the computer name and OS version from a compromised machine.

Proxysvc collects the OS version, country name, MAC address, computer name, and physical memory statistics.

Orz can gather the victim OS version and whether it is 64 or 32 bit.

NOKKI can gather information on the operating system on the victim’s machine.

yty gathers the computer name, CPU information, Microsoft Windows version, and runs the command systeminfo.

Backdoor.Oldrea collects information about the OS and computer name.

Stuxnet collects system information including computer and domain names, OS version, and S7P paths.

IronWind can capture the OS version and computer name of the compromised host.

RotaJakiro executes a set of commands to collect device information, including `uname`. Another example is the `cat /etc/*release | uniq` command used to collect the current OS distribution.

Get2 has the ability to identify the computer name and Windows version of an infected host.

POWRUNER may collect information about the system by running hostname and systeminfo on a victim.

SharpStage has checked the system settings to see if Arabic is the configured language.

Sardonic has the ability to collect the computer name, and CPU manufacturer name from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.

HALFBAKED can obtain information about the OS, processor, and BIOS.

The initial beacon packet for Misdat contains the operating system version of the victim.

Emissary has the capability to execute ver and systeminfo commands.

KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, and time elapsed since system start.

BUBBLEWRAP collects system information, including the operating system version and hostname.

HAWKBALL can collect the OS version, architecture information, and computer name.

Ursnif has used Systeminfo to gather system information.

ThreatNeedle can collect system profile information from a compromised host.

RansomHub can retrieve information about virtual machines.

ZLib has the ability to enumerate system information.

RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.

Tsundere Botnet has collected the machine’s MAC address, total memory, GPU information and other system information.

LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing `first_run()` to identify the first four bytes of the motherboard serial number.

Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.

Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.

Havoc can gather system information including hostname, domain, and OS details.

CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.

GravityRAT collects the MAC address, computer name, and CPU information.

InvisibleFerret has collected OS type, hostname and system version through the "pay" module. InvisibleFerret has also queried the victim device using Python scripts to obtain the User and Hostname.

Bankshot gathers system information, network addresses, and the operation system version.

can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.

PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.

Pony has collected the Service Pack, language, and region information to send to the C2.

WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.

TONESHELL has the ability to retrieve the name of the infected machine.

Kasidet has the ability to obtain a victim's system name and operating system version.