diff --git a/modules/post/multi/gather/check_malware.rb b/modules/post/multi/gather/check_malware.rb
index 5804c8562d..b44ce1f005 100644
--- a/modules/post/multi/gather/check_malware.rb
+++ b/modules/post/multi/gather/check_malware.rb
@@ -32,7 +32,7 @@ class Metasploit3 < Msf::Post
   end
 
   def rhost
-    session.sock.peerhost
+    session.session_host
   end
 
   def get_report(api_key, checksum)