Procedure examples

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

cd00r can discover the IP for the network interface on the compromised device.

PowerDuke has a command to get the victim's domain and NetBIOS name.

EKANS can determine the domain of a compromised host.

BLINDINGCAN has collected the victim machine's local IP address information and MAC address.

Ninja can enumerate the IP address on compromised systems.

Pikabot gathers victim network information through commands such as ipconfig and ipconfig /all.

Amadey can identify the IP address of a victim machine.

Proxysvc collects the network adapter information and domain/username information based on current remote sessions.

Orz can gather victim proxy information.

Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.

NOKKI can gather information on the victim IP address.

yty runs ipconfig /all and collects the domain name.

Backdoor.Oldrea collects information about the Internet adapter configuration.

Stuxnet collects the IP address of a compromised system.

POWRUNER may collect network configuration data by running ipconfig /all on a victim.

KOPILUWAK can use Arp to discover a target's network configuration setttings.

Sardonic has the ability to execute the `ipconfig` command.

Emissary has the capability to execute the command ipconfig /all.

KEYMARBLE gathers the MAC address of the victim’s machine.

RedLeaves can obtain information about network parameters.

Felismus collects the victim LAN IP address and sends it to the C2 server.

GeminiDuke collects information on network settings and Internet proxy settings from the victim.

Havoc has a module for network enumeration including determining IP addresses.

GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.

InvisibleFerret has collected the local IP address, and external IP.

StrongPity can identify the IP address of a compromised host.

xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.

PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.

OceanSalt can collect the victim’s IP address.

Brave Prince gathers network configuration information as well as the ARP cache.

AppleSeed can identify the IP of a targeted system.

NETWIRE can collect the IP address of a compromised host.

J-magic can compare the host and remote IPs to check if a received packet is from the infected machine.

iKitten will look for the current IP address.

Gomir collects network information on infected systems such as listing interface names, MAC and IP addresses, and IPv6 addresses.

Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.

Olympic Destroyer uses API calls to enumerate the infected system's ARP table.

BOLDMOVE enumerates network interfaces on the infected host.

Crimson contains a command to collect the victim MAC address and LAN IP.

DUSTTRAP can enumerate infected system network information.

Turian can retrieve the internal IP address of a compromised host.

Machete collects the MAC address of the target computer and other network configuration information.

Action RAT has the ability to collect the MAC address of an infected host.

Avenger can identify the domain of the compromised host.

A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.

PUBLOAD has obtained information about local networks through the `ipconfig /all` command.

Gootloader can use an embedded script to check the IP address of potential victims visiting compromised websites.

PingPull can retrieve the IP address of a compromised host.

WellMess can identify the IP address and user domain on the target machine.