Malware

Magic Hound

Magic Hound is malware associated in the provided content with host reconnaissance, collection, and command-and-control activity. Reported capabilities include obtaining the victim username and sending it to the C2 server; gathering the victim’s local IP address, MAC address, and external IP address; listing running processes; taking screenshots and uploading them to its C2 server; and determining whether the C2 server wants a newly dropped file executed in a hidden window. The malware has used HTTP for C2 communications. Based on the provided content, its observed behavior is consistent with a backdoor or RAT used for victim profiling, surveillance, and follow-on payload execution.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

Multiple malware and threat groups are described as collecting the current username or user/session details, frequently via built-in OS commands/APIs (e.g., "whoami", "query user", "quser", GetUserNameA) and via WMI/PowerShell.

T1057Process DiscoveryEvidence1

"...used tasklist to enumerate processes..."; "...used the ps command to list processes..."; "...calling CreateToolhelp32Snapshot... to enumerate the running processes..."

T1082System Information DiscoveryEvidence1

Multiple malware families and threat groups are described as collecting the victim username or enumerating logged-on users (e.g., “can collect the username from the victim’s machine”, “enumerates the current user during the initial infection”, “enumerates logged-on users”).

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

"Magic Hound malware can use a SOAP Web service to communicate with its C2 server."; "OilCheck can use a REST-based Microsoft Graph API ... used for C2 communication."

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attackNews

Jan 25, 2026

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Malware capable of enumerating running processes for reconnaissance.

mitre attackNews

Jan 25, 2026

Application Layer Protocol: Web Protocols, Sub-technique T1071.001 - Enterprise | MITRE ATT&CK®

Malware observed using HTTP for command-and-control (C2).

mitre attackNews

Jan 25, 2026

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Malware that captures screenshots and uploads them to C2.

mitre attackNews

Jan 25, 2026

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Malware that collects local IP, MAC, and external IP address information from victims.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Magic Hound