Stealer/1.0 victim fingerprint profile string generation (victim_id/ram_gb/disk_

Subhankar H@Andrewsec57

•updated Aug 31, 2026•0•0•1

Detects command-line activity indicative of stealer malware behavior, specifically the construction of victim fingerprinting strings by querying environment variables such as computer name, username, disk size, and RAM capacity. This behavior is commonly associated with initial reconnaissance phases of information-stealing malware.