Executive Summary
Stealer/1.0 is a sophisticated hybrid malware that combines the features of a credential stealer with a destructive wiper. The malware targets a wide range of sensitive data including browser passwords, AWS credentials, SSH keys, and developer tokens (Docker, npm, Maven). Its primary exfiltration method utilizes hardcoded Discord webhooks, a common tactic for low-cost, effective Command and Control (C2) infrastructure.
Technically, the malware exhibits aggressive defense evasion by disabling Windows Defender, firewalls, and UAC, while simultaneously terminating a long list of popular antivirus processes. After successful data harvesting, it initiates a 'destruction' phase that deletes Volume Shadow Copies, suppresses system recovery options, and triggers a forced system format and reboot. The presence of Russian and Ukrainian government domains in its connectivity check lists suggests specific geopolitical targeting or reconnaissance interests, although precise attribution remains unconfirmed.
This threat poses a significant risk to organizational continuity. By combining data theft with host destruction, the adversary not only compromises sensitive information but also intentionally hinders incident response and forensic recovery efforts, maximizing the operational impact on the victim.