Procedure examples

BOLDMOVE enumerates network interfaces on the infected host.

Crimson contains a command to collect the victim MAC address and LAN IP.

DUSTTRAP can enumerate infected system network information.

Turian can retrieve the internal IP address of a compromised host.

Machete collects the MAC address of the target computer and other network configuration information.

Action RAT has the ability to collect the MAC address of an infected host.

Avenger can identify the domain of the compromised host.

A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.

PUBLOAD has obtained information about local networks through the `ipconfig /all` command.

Gootloader can use an embedded script to check the IP address of potential victims visiting compromised websites.

PingPull can retrieve the IP address of a compromised host.

WellMess can identify the IP address and user domain on the target machine.

Woody RAT can retrieve network interface and proxy information.

Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.

Squirrelwaffle has collected the victim’s external IP address.

HexEval Loader has leveraged server-side client configurations to identify the public IP of the victim host.

ShrinkLocker captures the IP address of the victim system and sends this to the attacker following encryption.

Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.

Rifdoor has the ability to identify the IP address of the compromised host.

InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

Naid collects the domain name from a compromised host.

Volgmer can gather the IP address from the victim's machine.

ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.

Okrum can collect network information, including the host IP address, DNS, and proxy information.

Bonadan can find the external IP address of the infected host.

Neoichor can gather the IP address from an infected host.

Conti can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.

Diavol can enumerate victims' local and external IPs when registering with C2.

IcedID used the `ipconfig /all` command and a batch script to gather network information.

VERMIN gathers the local IP address.

Nightdoor gathers information on victim system network configuration such as MAC addresses.

PowerShower has the ability to identify the current Windows domain of the infected host.

Kazuar gathers information about network adapters.

FatDuke can identify the MAC address on the target computer.

Lucifer can collect the IP address of a compromised host.

BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.

zwShell can obtain the victim IP address.

Rising Sun can detect network adapter and IP address information.

Chrommme can enumerate the IP address of a compromised host.

Avaddon can collect the external IP address of the victim.

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

Flagpro has been used to execute the ipconfig /all command on a victim system.

SpicyOmelette can identify the IP of a compromised system.

Green Lambert can obtain proxy information from a victim's machine using system environment variables.

GoldMax retrieved a list of the system's network interface after execution.

KeyBoy can determine the public or WAN IP address for the system.

Anchor can determine the public IP and location of a compromised host.

Dyre has the ability to identify network settings on a compromised host.

LunarLoader can verify the targeted host's DNS name which is then used in the creation of a decyrption key.

PlugX has captured victim IP address details of the targeted machine.