Procedure examples

Havoc has a module for network enumeration including determining IP addresses.

GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.

InvisibleFerret has collected the local IP address, and external IP.

StrongPity can identify the IP address of a compromised host.

xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.

PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.

OceanSalt can collect the victim’s IP address.

Brave Prince gathers network configuration information as well as the ARP cache.

AppleSeed can identify the IP of a targeted system.

NETWIRE can collect the IP address of a compromised host.

J-magic can compare the host and remote IPs to check if a received packet is from the infected machine.

iKitten will look for the current IP address.

Gomir collects network information on infected systems such as listing interface names, MAC and IP addresses, and IPv6 addresses.

Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.

Olympic Destroyer uses API calls to enumerate the infected system's ARP table.

BOLDMOVE enumerates network interfaces on the infected host.

Crimson contains a command to collect the victim MAC address and LAN IP.

DUSTTRAP can enumerate infected system network information.

Turian can retrieve the internal IP address of a compromised host.

Machete collects the MAC address of the target computer and other network configuration information.

Action RAT has the ability to collect the MAC address of an infected host.

Avenger can identify the domain of the compromised host.

A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.

PUBLOAD has obtained information about local networks through the `ipconfig /all` command.

Gootloader can use an embedded script to check the IP address of potential victims visiting compromised websites.

PingPull can retrieve the IP address of a compromised host.

WellMess can identify the IP address and user domain on the target machine.

Woody RAT can retrieve network interface and proxy information.

Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.

Squirrelwaffle has collected the victim’s external IP address.

HexEval Loader has leveraged server-side client configurations to identify the public IP of the victim host.

ShrinkLocker captures the IP address of the victim system and sends this to the attacker following encryption.

Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.

Rifdoor has the ability to identify the IP address of the compromised host.

InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

Naid collects the domain name from a compromised host.

Volgmer can gather the IP address from the victim's machine.

ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.

Okrum can collect network information, including the host IP address, DNS, and proxy information.

Bonadan can find the external IP address of the infected host.

Neoichor can gather the IP address from an infected host.

Conti can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.

Diavol can enumerate victims' local and external IPs when registering with C2.

IcedID used the `ipconfig /all` command and a batch script to gather network information.

VERMIN gathers the local IP address.

Nightdoor gathers information on victim system network configuration such as MAC addresses.

PowerShower has the ability to identify the current Windows domain of the infected host.

Kazuar gathers information about network adapters.

FatDuke can identify the MAC address on the target computer.

Lucifer can collect the IP address of a compromised host.