Procedure examples

Shamoon obtains the target's IP address and local network segment.

A JHUHUGIT variant gathers network interface card information.

BLUELIGHT can collect IP information from the victim’s machine.

down_new has the ability to identify the MAC address of a compromised host.

Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.

RedLine Stealer can enumeate information about victims’ systems including IP addresses.

Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.

RogueRobin gathers the IP address and domain from the victim’s machine.

BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.

SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.

Mosquito uses the ipconfig command.

QUIETCANARY can identify the default proxy setting on a compromised host.

Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.

WellMail can identify the IP address of the victim system.

LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.

Sibot checked if the compromised system is configured to use proxies.

Bazar can collect the IP address and NetBIOS name of an infected machine.

Kobalos can record the IP address of the target machine.

RATANKBA gathers the victim’s IP address via the ipconfig -all command.

BADCALL collects the network adapter information.

MoonWind obtains the victim IP address.

Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.

Pysa can perform network reconnaissance using the Advanced IP Scanner tool.

Zebrocy runs the ipconfig /all command.

SpeakUp uses the ifconfig -a command.

Cobalt Strike can determine the NetBios name and the IP addresses of targets machines including domain controllers.

SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.

HotCroissant has the ability to identify the IP address of the compromised machine.

Unknown Logger can obtain information about the victim's IP address.

Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.

OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.

Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.

Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.

NanoCore gathers the IP address from the victim’s machine.

TajMahal has the ability to identify the MAC address on an infected host.

Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.

Calisto runs the ifconfig command to obtain the IP address from the victim’s machine.

Pisloader has a command to collect the victim's IP address.

Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Revenge RAT collects the IP address and MAC address from the system.

MacMa can collect IP addresses from a compromised host.

FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.

More_eggs has the capability to gather the IP address from the victim's machine.

SysUpdate can collected the IP address and domain name of a compromised host.

Kwampirs collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation.

DEADEYE can discover the DNS domain name of a targeted system.

LAMEHUG can enumerate network information on compromised hosts.

Kessel has collected the DNS address of the infected host.

GrimAgent can enumerate the IP and domain of a target system.