Procedure examples

Reaver collects the victim's IP address.

Bisonal can execute ipconfig on the victim’s machine.

S-Type has used `ipconfig /all` on a compromised host.

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.

Sykipot may use ipconfig /all to gather system network configuration details.

Explosive has collected the MAC address from the victim's machine.

Xbash can collect IP addresses and local intranet information from a victim’s machine.

Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.

LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.

Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.

Clambling can enumerate the IP address of a compromised machine.

NanHaiShu can gather information about the victim proxy server.

NGLite identifies the victim system MAC and IPv4 addresses and uses these to establish a victim identifier.

Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.

SHARPSTATS has the ability to identify the domain of the compromised host.

Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.

Elise executes ipconfig /all after initial communication is made to the remote server.

USBferry can detect the infected machine's network topology using ipconfig and arp.

WannaCry will attempt to determine the local network segment it is a part of.

TSCookie has the ability to identify the IP of the infected host.

Latrodectus can discover the IP and MAC address of a targeted host.

Saint Bot can collect the IP address of a victim machine.

Pay2Key can identify the IP and MAC addresses of the compromised host.

LODEINFO can enumerate the MAC address of the compromised host.

CharmPower has the ability to use ipconfig to enumerate system network settings.

QUADAGENT gathers the current domain the victim system belongs to.

Sagerunex will gather system information such as MAC and IP addresses.

Sys10 collects the local IP address of the victim and sends it to the C2.

Royal can enumerate IP addresses using `GetIpAddrTable`.

Trojan.Karagany can gather information on the network configuration of a compromised host.

Bandook has a command to get the public IP address from a system.

PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.

MagicRAT collects system network information using commands such as `ipconfig /all`.

KONNI can collect the IP address from the victim’s machine.

T9000 gathers and beacons the MAC and IP addresses during installation.

Shamoon obtains the target's IP address and local network segment.

A JHUHUGIT variant gathers network interface card information.

BLUELIGHT can collect IP information from the victim’s machine.

down_new has the ability to identify the MAC address of a compromised host.

Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.

RedLine Stealer can enumeate information about victims’ systems including IP addresses.

Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.

RogueRobin gathers the IP address and domain from the victim’s machine.

BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.

SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.

Mosquito uses the ipconfig command.

QUIETCANARY can identify the default proxy setting on a compromised host.

Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.

WellMail can identify the IP address of the victim system.

LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.