Procedure examples

BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.

zwShell can obtain the victim IP address.

Rising Sun can detect network adapter and IP address information.

Chrommme can enumerate the IP address of a compromised host.

Avaddon can collect the external IP address of the victim.

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

Flagpro has been used to execute the ipconfig /all command on a victim system.

SpicyOmelette can identify the IP of a compromised system.

Green Lambert can obtain proxy information from a victim's machine using system environment variables.

GoldMax retrieved a list of the system's network interface after execution.

KeyBoy can determine the public or WAN IP address for the system.

Anchor can determine the public IP and location of a compromised host.

Dyre has the ability to identify network settings on a compromised host.

LunarLoader can verify the targeted host's DNS name which is then used in the creation of a decyrption key.

PlugX has captured victim IP address details of the targeted machine.

Reaver collects the victim's IP address.

Bisonal can execute ipconfig on the victim’s machine.

S-Type has used `ipconfig /all` on a compromised host.

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.

Sykipot may use ipconfig /all to gather system network configuration details.

Explosive has collected the MAC address from the victim's machine.

Xbash can collect IP addresses and local intranet information from a victim’s machine.

Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.

LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.

Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.

Clambling can enumerate the IP address of a compromised machine.

NanHaiShu can gather information about the victim proxy server.

NGLite identifies the victim system MAC and IPv4 addresses and uses these to establish a victim identifier.

Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.

SHARPSTATS has the ability to identify the domain of the compromised host.

Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.

Elise executes ipconfig /all after initial communication is made to the remote server.

USBferry can detect the infected machine's network topology using ipconfig and arp.

WannaCry will attempt to determine the local network segment it is a part of.

TSCookie has the ability to identify the IP of the infected host.

Latrodectus can discover the IP and MAC address of a targeted host.

Saint Bot can collect the IP address of a victim machine.

Pay2Key can identify the IP and MAC addresses of the compromised host.

LODEINFO can enumerate the MAC address of the compromised host.

CharmPower has the ability to use ipconfig to enumerate system network settings.

QUADAGENT gathers the current domain the victim system belongs to.

Sagerunex will gather system information such as MAC and IP addresses.

Sys10 collects the local IP address of the victim and sends it to the C2.

Royal can enumerate IP addresses using `GetIpAddrTable`.

Trojan.Karagany can gather information on the network configuration of a compromised host.

Bandook has a command to get the public IP address from a system.

PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.

MagicRAT collects system network information using commands such as `ipconfig /all`.

KONNI can collect the IP address from the victim’s machine.

T9000 gathers and beacons the MAC and IP addresses during installation.