The started command will send the following information to the C&C:  device_model: the model identifier (e.g.: MacBookPro9,2) bot_version: version of Keydnap build_name: the “build name” that was given by downloader os_version: OS X or macOS kernel version ip_address: external IP address as reported by ipify.org has_root: 1 if executed as root, 0 otherwise  Backdoor commands The response to get_task contains an integer to identify the type of command and optional arguments