Procedure examples

RedLine Stealer has obtained the username from the victim’s machine.

RogueRobin collects the victim’s username and whether that user is an admin.

LitePower can determine if the current user has admin privileges.

SDBbot has the ability to identify the user on a compromised host.

Mosquito runs whoami on the victim’s machine.

RTM can obtain the victim username and permissions.

A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.

SodaMaster can identify the username on a compromised host.

Grandoreiro can collect the username from the victim's machine.

WellMail can identify the current username on the victim system.

LiteDuke can enumerate the account name on a targeted system.

ZxxZ can collect the username from a compromised host.

WINDSHIELD can gather the victim user name.

Bazar can identify the username of the infected user.

RATANKBA runs the whoami and query user commands.

XLoader can identify the username from a victim machine.

MoonWind obtains the victim username.

HiddenFace can collect the username associated with the compromised host.

Cryptoistic can gather data on the user of a compromised host.

MgBot includes modules for identifying local users and administrators on victim machines.

Zebrocy gets the username from the system.

SpeakUp uses the whoami command.

SUNBURST collected the username from a compromised host.

HotCroissant has the ability to collect the username on the infected host.

ServHelper will attempt to enumerate the username of the victim.

Unknown Logger can obtain information about the victim usernames.

Valak can gather information regarding the user.

Milan can identify users registered to a targeted machine.

OilBooster can identify the compromised system's username which is then used as part of a unique identifier.

Raccoon Stealer gathers information on the infected system owner and user.

Cardinal RAT can collect the username from a victim machine.

BISCUIT has a command to gather the username from the system.

Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.

RGDoor executes the whoami on the victim’s machine.

Revenge RAT gathers the username from the system.

MacMa can collect the username from the compromised machine.

FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.

More_eggs has the capability to gather the username from the victim's machine.

SysUpdate can collect the username from a compromised host.

Kwampirs collects registered owner details by using the commands systeminfo and net config workstation.

BoomBox can enumerate the username on a compromised host.

LAMEHUG can use `whoami` to enumerate the system user.

Mango can collect the user name from a compromised system which is used to create a unique victim identifier.

GrimAgent can identify the user id on a target machine.

Lokibot has the ability to discover the username on the infected host.

Egregor has used tools to gather information about users.

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.

FELIXROOT collects the username from the victim’s machine.

ZxShell can collect the owner and organization information from the target workstation.

NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.