Academy
TermData

Hardware ID

(HWID)

A unique identifier the infostealer generates for the infected device from hardware and system values.

Flow

  1. 1Values read
  2. 2ID generated
  3. 3Matches logs
Related families
Lumma Stealer
MITRE ATT&CK
T1082 · System Information Discovery
Sources
4 sources
01

Overview

The hardware ID identifies the device in logs: it helps remove repeated logs from the same device and see whether a device was infected more than once. MITRE ATT&CK

The ID is usually computed from values such as the disk serial number, processor information and username; its format varies by family. Malpedia (Fraunhofer FKIE)

Windows’ own “hardware ID” concept is something else: a string defined by the vendor and used to match a device to its driver. The HWID in logs is a value generated by the malware itself. Microsoft Learn

02

How it works

  1. 1

    Values read

    System information such as processor, disk, computer and user names is collected. MITRE ATT&CK

  2. 2

    ID generated

    The values are combined and hashed, then written to the system information file.

  3. 3

    Matches logs

    Logs carrying the same ID are treated as belonging to the same device.

03

Real-world examples

CISA: running in memory and sending system information

Lumma Stealer profile

According to CISA and the FBI, LummaC2 does not write files to disk without commands from the C2 server; it runs in memory, collects system information and sends it to the server. CISA and FBI (AA25-141B)

04

How to detect it

  • The hardware ID shows whether the same device was reinfected on different dates; a repeated ID indicates that cleanup was insufficient.
05

What to do

  • Reinstall a reinfected device; do not settle for deleting the malicious file.
06

MITRE ATT&CK

T1082System Information Discovery
07

Related families and terms

Families

Lumma StealerActive

Report

Infostealer Threat Report — October 2026

Terms

Stealer logsMalware pathAntidetect browser
08

Sources

  1. 1System Information Discovery (T1082) · MITRE ATT&CK
  2. 2Lumma Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  3. 3Hardware IDs · Microsoft Learn
  4. 4Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans