Hannibal Stealer system info collection via GetComputerNameEx and GetAdaptersInfo

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•2

Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.