Procedure examples

PureCrypter can retrieve the username from targeted machines.

NanHaiShu collects the username from the victim.

SVCReady can collect the username from an infected host.

NGLite will run the whoami command to gather system information and return this to the command and control server.

SHARPSTATS has the ability to identify the username on the compromised host.

Caterpillar WebShell can obtain a list of user accounts from a victim's machine.

Gazer obtains the current user's security identifier.

Latrodectus can discover the username of an infected host.

Saint Bot can collect the username from a compromised host.

Chaes has collected the username and UID from the infected machine.

LODEINFO can identify the associated username on targeted machines.

EVILNUM can obtain the username from the victim's machine.

SMOKEDHAM has used whoami commands to identify system owners.

QUADAGENT gathers the victim username.

Sys10 collects the account name of the logged-in user and sends it to the C2.

Metamorfo has collected the username from the victim's machine.

Trojan.Karagany can gather information about the user on a compromised host.

KONNI can collect the username from the victim’s machine.

T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.

DnsSystem can use the Windows user name to create a unique identification for infected users and systems.

BLUELIGHT can collect the username on a compromised host.

Ixeshe collects the username from the victim’s machine.

Micropsia collects the username from the victim’s machine.

RedLine Stealer has obtained the username from the victim’s machine.

RogueRobin collects the victim’s username and whether that user is an admin.

LitePower can determine if the current user has admin privileges.

SDBbot has the ability to identify the user on a compromised host.

Mosquito runs whoami on the victim’s machine.

RTM can obtain the victim username and permissions.

A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.

SodaMaster can identify the username on a compromised host.

Grandoreiro can collect the username from the victim's machine.

WellMail can identify the current username on the victim system.

LiteDuke can enumerate the account name on a targeted system.

ZxxZ can collect the username from a compromised host.

WINDSHIELD can gather the victim user name.

Bazar can identify the username of the infected user.

RATANKBA runs the whoami and query user commands.

XLoader can identify the username from a victim machine.

MoonWind obtains the victim username.

HiddenFace can collect the username associated with the compromised host.

Cryptoistic can gather data on the user of a compromised host.

MgBot includes modules for identifying local users and administrators on victim machines.

Zebrocy gets the username from the system.

SpeakUp uses the whoami command.

SUNBURST collected the username from a compromised host.

HotCroissant has the ability to collect the username on the infected host.

ServHelper will attempt to enumerate the username of the victim.

Unknown Logger can obtain information about the victim usernames.

Valak can gather information regarding the user.