Procedure examples

NGLite identifies the victim system MAC and IPv4 addresses and uses these to establish a victim identifier.

Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.

SHARPSTATS has the ability to identify the domain of the compromised host.

Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.

Elise executes ipconfig /all after initial communication is made to the remote server.

USBferry can detect the infected machine's network topology using ipconfig and arp.

WannaCry will attempt to determine the local network segment it is a part of.

TSCookie has the ability to identify the IP of the infected host.

Latrodectus can discover the IP and MAC address of a targeted host.

Saint Bot can collect the IP address of a victim machine.

Pay2Key can identify the IP and MAC addresses of the compromised host.

LODEINFO can enumerate the MAC address of the compromised host.

CharmPower has the ability to use ipconfig to enumerate system network settings.

QUADAGENT gathers the current domain the victim system belongs to.

Sagerunex will gather system information such as MAC and IP addresses.

Sys10 collects the local IP address of the victim and sends it to the C2.

Royal can enumerate IP addresses using `GetIpAddrTable`.

Trojan.Karagany can gather information on the network configuration of a compromised host.

Bandook has a command to get the public IP address from a system.

PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.

MagicRAT collects system network information using commands such as `ipconfig /all`.

KONNI can collect the IP address from the victim’s machine.

T9000 gathers and beacons the MAC and IP addresses during installation.

Shamoon obtains the target's IP address and local network segment.

A JHUHUGIT variant gathers network interface card information.

BLUELIGHT can collect IP information from the victim’s machine.

down_new has the ability to identify the MAC address of a compromised host.

Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.

RedLine Stealer can enumeate information about victims’ systems including IP addresses.

Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.

RogueRobin gathers the IP address and domain from the victim’s machine.

BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.

SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.

Mosquito uses the ipconfig command.

QUIETCANARY can identify the default proxy setting on a compromised host.

Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.

WellMail can identify the IP address of the victim system.

LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.

Sibot checked if the compromised system is configured to use proxies.

Bazar can collect the IP address and NetBIOS name of an infected machine.

Kobalos can record the IP address of the target machine.

RATANKBA gathers the victim’s IP address via the ipconfig -all command.

BADCALL collects the network adapter information.

MoonWind obtains the victim IP address.

Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.

Pysa can perform network reconnaissance using the Advanced IP Scanner tool.

Zebrocy runs the ipconfig /all command.

SpeakUp uses the ifconfig -a command.

Cobalt Strike can determine the NetBios name and the IP addresses of targets machines including domain controllers.

SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.