Procedure examples

Lokibot has the ability to discover the domain name of the infected host.

FELIXROOT collects information about the network including the IP address and DHCP server.

Penquin can report the IP of the compromised host to attacker controlled infrastructure.

BabyShark has executed the ipconfig /all command.

CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.

Troll Stealer collects the MAC address of victim devices.

Manjusaka gathers information about current network connections, local and remote addresses associated with them, and associated processes.

The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.

JPIN can obtain network information, including DNS, IP, and proxies.

SideTwist has the ability to collect the domain name on a compromised host.

Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.

LunarWeb can use shell commands to discover network adapters and configuration.

Octopus can collect the host IP address from the victim’s machine.

Qilin can accept a command line argument identifying specific IPs.

SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.

STARWHALE has the ability to collect the IP address of an infected host.

Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.

Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.

Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.

POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.

ShadowPad has collected the domain name of the victim system.

Astaroth collects the external IP address from the system.

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

jRAT can gather victim internal and external IPs.

Denis uses ipconfig to gather the IP address from the system.

Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.

OSInfo discovers the current domain information.

Lizar has retrieved network information from a compromised host, such as the MAC address.

Dtrack can collect the host's IP addresses using the ipconfig command.

LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.

Azorult can collect host IP information from the victim’s machine.

UPPERCUT has the capability to gather the victim's proxy information.

FALLCHILL collects MAC address and local IP address information from the victim.

XORIndex Loader has leveraged webservices to identify the public IP of the victim host.

Small Sieve can obtain the IP address of a victim host.

ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.

Sliver has the ability to gather network configuration information.

evilginx2 can capture information from each session with a victim including the public IP used to access the server and the user agent.

ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.

Arp can be used to display ARP configuration information on the host.

Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.

ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.

PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.

PoshC2 can enumerate network adapter information.

AsyncRAT can enumerate the NetBIOS name on targeted machines.

Nltest may be used to enumerate the parent domain of a local machine using /parentdomain.

nbtstat can be used to discover local NetBIOS domain names.

NBTscan can be used to collect MAC addresses.

route can be used to discover routing configuration information.

CrackMapExec can collect DNS information from the targeted system.