Wiper
CaddyWiper
aka KillDisk.NCX
CaddyWiper is another destructive malware believed to be deployed to target Ukraine.
CaddyWiper, also known as KillDisk.NCX, is a Windows wiper operated by APT28 and Sandworm.
Background
CaddyWiper is yet another destructive strain thought to have been used against targets in Ukraine.
The wiper destroys every file beneath C:\Users as well as all files on any drive from D: through Z: by overwriting their contents with NULL bytes. When a file exceeds 0xA00000 bytes (10MB), only the initial 0xA00000 bytes are overwritten.
It additionally corrupts disk partitions, iterating from \.\PHYSICALDRIVE9 down to \.\PHYSICALDRIVE0 and overwriting the first 0x780 bytes of each with NULL.
Source: Malpedia (Fraunhofer FKIE).