Procedure examples

PowerDuke has commands to get the time the machine was built, the time, and the time zone.

GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.

As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.

Torisma can collect the current time on a victim machine.

NOKKI can collect the current timestamp of the victim's machine.

Stuxnet collects the time and date of a system when it is infected.

AvosLocker has checked the system time before and after encryption.

PAKLOG has collected a timestamp to log the precise time a key was pressed, formatted as %Y-%m-%d %H:%M:%S.

WindTail has the ability to generate the current date and time.

Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.

GravityRAT can obtain the date and time of a system.

Medusa Ransomware has discovered device uptime through `GetTickCount()`.

AppleSeed can pull a timestamp from the victim's machine.

Crimson has the ability to determine the date and time on a compromised host.

DUSTTRAP reads the infected system's current time and writes it to a log file during execution.

BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.

PUBLOAD has collected the machine’s tick count through the use of `GetTickCount`.

SystemBC has leveraged the time of the device to create a text file with a filename that uses the function of `uniqid(time()).‘.txt`, consisting of the 10 character UNIX timestamp and 13 hexadecimal characters.

ShrinkLocker retrieves a system timestamp that is used in generating an encryption key.

SombRAT can execute getinfo to discover the current time on a compromised host.

HOPLIGHT has been observed collecting system time from victim machines.

InvisiMole gathers the local system time from the victim’s machine.

Okrum can obtain the date and time of the compromised system.

Nightdoor can identify the system local time information.

DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.

DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.

Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.

Green Lambert can collect the date and time from a compromised host.

GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.

BeaverTail has obtained and sent the current timestamp associated with the victim device to C2.

DarkWatchman can collect time zone information and system `UPTIME`.

PlugX has identified system time through its GetSystemInfo command.

Bisonal can check the system time set on the infected host.

Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.

KEYPLUG can obtain the current tick count of an infected computer.

Clambling can determine the current time.

DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.

SVCReady can collect time zone information.

SHARPSTATS has the ability to identify the current date and time on the compromised host.

LODEINFO can capture system time to send to the C2.

TAINTEDSCRIBE can execute GetLocalTime for time discovery.

BendyBear has the ability to determine local time on a compromised host.

GlassWorm has the ability to check the system’s time zone on the victim device.

Metamorfo uses JavaScript to get the system time.

PipeMon can send time zone information from a compromised host to C2.

T9000 gathers and beacons the system time during installation.

Shamoon obtains the system time and will only activate if it is greater than a preset date.

BLUELIGHT can collect the local time on a compromised host.

StoneDrill can obtain the current date and time of the victim machine.

OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.