Procedure examples

HotCroissant has the ability to identify the IP address of the compromised machine.

Unknown Logger can obtain information about the victim's IP address.

Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.

OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.

Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.

Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.

NanoCore gathers the IP address from the victim’s machine.

TajMahal has the ability to identify the MAC address on an infected host.

Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.

Calisto runs the ifconfig command to obtain the IP address from the victim’s machine.

Pisloader has a command to collect the victim's IP address.

Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Revenge RAT collects the IP address and MAC address from the system.

MacMa can collect IP addresses from a compromised host.

FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.

More_eggs has the capability to gather the IP address from the victim's machine.

SysUpdate can collected the IP address and domain name of a compromised host.

Kwampirs collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation.

DEADEYE can discover the DNS domain name of a targeted system.

LAMEHUG can enumerate network information on compromised hosts.

Kessel has collected the DNS address of the infected host.

GrimAgent can enumerate the IP and domain of a target system.

Lokibot has the ability to discover the domain name of the infected host.

FELIXROOT collects information about the network including the IP address and DHCP server.

Penquin can report the IP of the compromised host to attacker controlled infrastructure.

BabyShark has executed the ipconfig /all command.

CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.

Troll Stealer collects the MAC address of victim devices.

Manjusaka gathers information about current network connections, local and remote addresses associated with them, and associated processes.

The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.

JPIN can obtain network information, including DNS, IP, and proxies.

SideTwist has the ability to collect the domain name on a compromised host.

Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.

LunarWeb can use shell commands to discover network adapters and configuration.

Octopus can collect the host IP address from the victim’s machine.

Qilin can accept a command line argument identifying specific IPs.

SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.

STARWHALE has the ability to collect the IP address of an infected host.

Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.

Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.

Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.

POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.

ShadowPad has collected the domain name of the victim system.

Astaroth collects the external IP address from the system.

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

jRAT can gather victim internal and external IPs.

Denis uses ipconfig to gather the IP address from the system.

Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.

OSInfo discovers the current domain information.