Procedure examples

Woody RAT can retrieve network interface and proxy information.

Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.

Squirrelwaffle has collected the victim’s external IP address.

HexEval Loader has leveraged server-side client configurations to identify the public IP of the victim host.

ShrinkLocker captures the IP address of the victim system and sends this to the attacker following encryption.

Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.

Rifdoor has the ability to identify the IP address of the compromised host.

InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

Naid collects the domain name from a compromised host.

Volgmer can gather the IP address from the victim's machine.

ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.

Okrum can collect network information, including the host IP address, DNS, and proxy information.

Bonadan can find the external IP address of the infected host.

Neoichor can gather the IP address from an infected host.

Conti can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.

Diavol can enumerate victims' local and external IPs when registering with C2.

IcedID used the `ipconfig /all` command and a batch script to gather network information.

VERMIN gathers the local IP address.

Nightdoor gathers information on victim system network configuration such as MAC addresses.

PowerShower has the ability to identify the current Windows domain of the infected host.

Kazuar gathers information about network adapters.

FatDuke can identify the MAC address on the target computer.

Lucifer can collect the IP address of a compromised host.

BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.

zwShell can obtain the victim IP address.

Rising Sun can detect network adapter and IP address information.

Chrommme can enumerate the IP address of a compromised host.

Avaddon can collect the external IP address of the victim.

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

Flagpro has been used to execute the ipconfig /all command on a victim system.

SpicyOmelette can identify the IP of a compromised system.

Green Lambert can obtain proxy information from a victim's machine using system environment variables.

GoldMax retrieved a list of the system's network interface after execution.

KeyBoy can determine the public or WAN IP address for the system.

Anchor can determine the public IP and location of a compromised host.

Dyre has the ability to identify network settings on a compromised host.

LunarLoader can verify the targeted host's DNS name which is then used in the creation of a decyrption key.

PlugX has captured victim IP address details of the targeted machine.

Reaver collects the victim's IP address.

Bisonal can execute ipconfig on the victim’s machine.

S-Type has used `ipconfig /all` on a compromised host.

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.

Sykipot may use ipconfig /all to gather system network configuration details.

Explosive has collected the MAC address from the victim's machine.

Xbash can collect IP addresses and local intranet information from a victim’s machine.

Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.

LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.

Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.

Clambling can enumerate the IP address of a compromised machine.

NanHaiShu can gather information about the victim proxy server.