System Owner/User Discovery

Agent Tesla can collect the username from the victim’s machine.^[29][30][31]

Agent.btz obtains the victim username and saves it to a file.^[44]

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.^[92]

An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of "System."^[100]

APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine. ^[86][87][40]

APT37 identifies the victim username.^[88]

APT39 used Remexi to collect usernames from the system. ^[105]

APT41 used the WMIEXEC utility to execute whoami commands on remote machines.^[108]

Aria-body has the ability to identify the username on a compromised host.^[81]

Azorult can collect the username from the victim’s machine.^[38]

BabyShark has executed the whoami command.^[73]

Backdoor.Oldrea collects the current username from the victim.^[18]

BISCUIT has a command to gather the username from the system.^[21]

Cannon can gather the username from the system.^[37]

Cardinal RAT can collect the username from a victim machine.^[42]

DarkComet gathers the username from the victim’s machine.^[9]

Denis enumerates and collects the username from the victim’s machine.^[39][40]

A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.^[6]

DownPaper collects the victim username and sends it to the C2 server.^[25]

Dragonfly 2.0 used the command query user on victim hosts.^[104]

Dyre has the ability to identify the users on a compromised host.^[84]

Epic collects the user name from the victim’s machine.^[45]

Felismus collects the current username and sends it to the C2 server.^[33]

FELIXROOT collects the username from the victim’s machine.^[26][27]

FIN10 has used Meterpreter to enumerate users on remote systems.^[91]

FlawedAmmyy enumerates the current user during the initial infection.^[67]

Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.^[109]

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.^[101]

Gazer obtains the current user's security identifier.^[10]

Get2 has the ability to identify the current username of an infected host.^[83]

Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.^[5]

Goopy has the ability to enumerate the infected system's user name.^[40]

GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).^[20]

can collect the victim user name.^[4]

HAWKBALL can collect the user name of the system.^[71]

HotCroissant has the ability to collect the username on the infected host.^[75]

InvisiMole lists local users and session information.^[47]

Ixeshe collects the username from the victim’s machine.^[70]

JPIN can obtain the victim user name.^[43]

Kazuar gathers information on users.^[7]

Koadic can identify logged in users across the domain and views user sessions.^[2]

The OsInfo function in Komplex collects the current running username.^[61]

KONNI can collect the username from the victim’s machine.^[12]

Kwampirs collects registered owner details by using the commands systeminfo and net config workstation.^[34]

Various Lazarus Group malware enumerates logged-on users.^{[93][94][95][96][97]}

Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain. ^[64]

Lokibot has the ability to discover the username on the infected host.^[79]

Magic Hound malware has obtained the victim username and sent it to the C2 server.^[98]

MechaFlounder has the ability to identify the username and hostname on a compromised host.^[82]

Micropsia collects the username from the victim’s machine.^[14]

MirageFox can gather the username from the victim’s machine.^[49]

Mis-Type runs tests to determine the privilege level of the compromised user.^[11]

MoonWind obtains the victim username.^[52]

More_eggs has the capability to gather the username from the victim's machine.^[55][56]

Mosquito runs whoami on the victim’s machine.^[24]

MuddyWater has used malware that can collect the victim’s username.^[90]

NanHaiShu collects the username from the victim.^[19]

NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.^[28]

njRAT enumerates the current user during the initial infection.^[69]

NOKKI can collect the username from the victim’s machine.^[46]

Octopus collects the username from the victim’s machine.^[62]

OilRig has run whoami on a victim.^[102][103]

Okrum can collect the victim username.^[76]

Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.^[99][28]

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.^[74]

PowerDuke has commands to get the current user's name and SID.^[41]

PowerShower has the ability to identify the current user on the infected host.^[77]

POWERSTATS has the ability to identify the username on the compromised host.^[80]

POWRUNER may collect information about the currently logged in user by running whoami on a victim.^[23]

A module in Prikormka collects information from the victim about the current user name.^[53]

Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.^[1]

QUADAGENT gathers the victim username.^[59]

RATANKBA runs the whoami and query user commands.^[16]

Reaver collects the victim's username.^[17]

RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.^[3]

Remsec can obtain information about the current user.^[32]

Revenge RAT gathers the username from the system.^[66]

RGDoor executes the whoami on the victim’s machine.^[50]

Rifdoor has the ability to identify the username on the compromised host.^[75]

Rising Sun can detect the username of the infected host.^[78]

RogueRobin collects the victim’s username and whether that user is an admin.^[57]

RTM can obtain the victim username and permissions.^[48]

SDBot has the ability to identify the user on a compromised host.^[83]

ServHelper will attempt to enumerate the username of the victim.^[68]

SHARPSTATS has the ability to identify the username on the compromised host.^[80]

Soft Cell used whoami and query user to obtain information about the victim user.^[107]

SpeakUp uses the whoami command. ^[65]

SslMM sends the logged-on username to its hard-coded C2.^[36]

Stealth Falcon malware gathers the registered user and primary owner name via WMI.^[89]

SynAck gathers user names from infected hosts.^[54]

Sys10 collects the account name of the logged-in user and sends it to the C2.^[36]

T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.^[13]

Tropic Trooper used letmein to scan for saved usernames on the target system.^[106]

Unknown Logger can obtain information about the victim usernames.^[8]

UPPERCUT has the capability to collect the current logged on user’s username from a machine.^[22]

Valak can gather information regarding the user.^[85]

VERMIN gathers the username from the victim’s machine.^[60]

WINDSHIELD can gather the victim user name.^[58]

WINERACK can gather information on the victim username.^[4]

WinMM uses NetUser-GetInfo to identify that it is running under an "Admin" account on the local system.^[36]

XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.^[51]

yty collects the victim’s username.^[15]

Zebrocy gets the username from the system.^[63]

zwShell can obtain the name of the logged-in user on the victim.^[35]

ZxShell can collect the owner and organization information from the target workstation.^[72]