Procedure examples

PowerDuke has a command to write random data across a file and delete it.

BLINDINGCAN has deleted itself and associated artifacts from victim machines.

RCSession can remove files from a targeted system.

Bumblebee can uninstall its loader through the use of a `Sdl` command.

BRICKSTORM has the ability to delete files and directories. BRICKSTORM also has deleted installer files after execution to reduce detection.

MURKYTOP has the capability to delete local files.

RDFSNIFFER has the capability of deleting local files.

NICECURL has a function to remove artifacts.

Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.

NOKKI can delete files to cover tracks.

Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.

Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.

VersaMem deleted files related to initial installation such as temporary files related to the PID of the main web process.

TDTESS creates then deletes log files during installation of itself as a service.

COATHANGER removes files from victim environments following use in multiple instances.

HALFBAKED can delete a specified file.

WindTail has the ability to receive and execute a self-delete command.

Misdat is capable of deleting the backdoor file.

Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.

KEYMARBLE has the capability to delete files off the victim’s machine.

HAWKBALL has the ability to delete files.

Ursnif has deleted data staged in tmp files after exfiltration.

RansomHub has the ability to self-delete.

RedLeaves can delete specified files.

Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.

CARROTBAT has the ability to delete downloaded files from a compromised host.

Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.

StrongPity can delete previously exfiltrated files from the compromised host.

Pony has used scripts to delete itself after execution.

Nebulae has the ability to delete files and directories.

AuditCred can delete files from the system.

TONESHELL has deleted payload files received from the C2 server.

UPSTYLE removes `bootstrap.min.css` after parsing command and control instructions, restoring the file to its original state.

OceanSalt can delete files from the system.

Medusa Ransomware has the ability to delete itself after execution. Medusa Ransomware also has the ability to delete itself after execution through the command `cmd /c ping localhost -n 3 > nul & del`.

RainyDay has the ability to uninstall itself by deleting its service and files.

AppleSeed can delete files from a compromised host after they are exfiltrated.

PyDCrypt will remove all created artifacts such as dropped executables.

GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.

Gomir deletes its original executable and terminates its original process after creating a systemd service.

Aria-body has the ability to delete files and directories on compromised hosts.

BOLDMOVE can remove files on victim systems.

Crimson has the ability to delete files from a compromised host.

BADHATCH has the ability to delete PowerShell scripts from a compromised machine.

Once a file is uploaded, Machete will delete it from the machine.

After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.

Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.

ShrinkLocker can delete itself depending on various checks performed during execution.

Hildegard has deleted scripts after execution.

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.