Procedure examples

Sibot checked if the compromised system is configured to use proxies.

Bazar can collect the IP address and NetBIOS name of an infected machine.

Kobalos can record the IP address of the target machine.

RATANKBA gathers the victim’s IP address via the ipconfig -all command.

BADCALL collects the network adapter information.

MoonWind obtains the victim IP address.

Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.

Pysa can perform network reconnaissance using the Advanced IP Scanner tool.

Zebrocy runs the ipconfig /all command.

SpeakUp uses the ifconfig -a command.

Cobalt Strike can determine the NetBios name and the IP addresses of targets machines including domain controllers.

SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.

HotCroissant has the ability to identify the IP address of the compromised machine.

Unknown Logger can obtain information about the victim's IP address.

Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.

OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.

Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.

Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.

NanoCore gathers the IP address from the victim’s machine.

TajMahal has the ability to identify the MAC address on an infected host.

Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.

Calisto runs the ifconfig command to obtain the IP address from the victim’s machine.

Pisloader has a command to collect the victim's IP address.

Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Revenge RAT collects the IP address and MAC address from the system.

MacMa can collect IP addresses from a compromised host.

FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.

More_eggs has the capability to gather the IP address from the victim's machine.

SysUpdate can collected the IP address and domain name of a compromised host.

Kwampirs collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation.

DEADEYE can discover the DNS domain name of a targeted system.

LAMEHUG can enumerate network information on compromised hosts.

Kessel has collected the DNS address of the infected host.

GrimAgent can enumerate the IP and domain of a target system.

Lokibot has the ability to discover the domain name of the infected host.

FELIXROOT collects information about the network including the IP address and DHCP server.

Penquin can report the IP of the compromised host to attacker controlled infrastructure.

BabyShark has executed the ipconfig /all command.

CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.

Troll Stealer collects the MAC address of victim devices.

Manjusaka gathers information about current network connections, local and remote addresses associated with them, and associated processes.

The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.

JPIN can obtain network information, including DNS, IP, and proxies.

SideTwist has the ability to collect the domain name on a compromised host.

Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.

LunarWeb can use shell commands to discover network adapters and configuration.

Octopus can collect the host IP address from the victim’s machine.

Qilin can accept a command line argument identifying specific IPs.

SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.