Procedure examples

APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.

Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware.

APT5 has deleted scripts and web shells to evade detection.

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.

INC Ransom has uninstalled tools from compromised endpoints after use.

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.

Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.

Play has used tools including Wevtutil to remove malicious files from compromised hosts.

Magic Hound has deleted and overwrote files to cover tracks.

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.

FIN10 has used batch scripts and scheduled tasks to delete critical system files.

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.

PowerDuke has a command to write random data across a file and delete it.

BLINDINGCAN has deleted itself and associated artifacts from victim machines.

RCSession can remove files from a targeted system.

Bumblebee can uninstall its loader through the use of a `Sdl` command.

BRICKSTORM has the ability to delete files and directories. BRICKSTORM also has deleted installer files after execution to reduce detection.

MURKYTOP has the capability to delete local files.

RDFSNIFFER has the capability of deleting local files.

NICECURL has a function to remove artifacts.

Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.

NOKKI can delete files to cover tracks.

Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.

Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.

VersaMem deleted files related to initial installation such as temporary files related to the PID of the main web process.

TDTESS creates then deletes log files during installation of itself as a service.

COATHANGER removes files from victim environments following use in multiple instances.

HALFBAKED can delete a specified file.

WindTail has the ability to receive and execute a self-delete command.

Misdat is capable of deleting the backdoor file.

Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.

KEYMARBLE has the capability to delete files off the victim’s machine.

HAWKBALL has the ability to delete files.

Ursnif has deleted data staged in tmp files after exfiltration.

RansomHub has the ability to self-delete.

RedLeaves can delete specified files.

Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.

CARROTBAT has the ability to delete downloaded files from a compromised host.

Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.

StrongPity can delete previously exfiltrated files from the compromised host.

Pony has used scripts to delete itself after execution.

Nebulae has the ability to delete files and directories.

AuditCred can delete files from the system.

TONESHELL has deleted payload files received from the C2 server.

UPSTYLE removes `bootstrap.min.css` after parsing command and control instructions, restoring the file to its original state.

OceanSalt can delete files from the system.

Medusa Ransomware has the ability to delete itself after execution. Medusa Ransomware also has the ability to delete itself after execution through the command `cmd /c ping localhost -n 3 > nul & del`.

RainyDay has the ability to uninstall itself by deleting its service and files.

AppleSeed can delete files from a compromised host after they are exfiltrated.