Procedure examples

PyDCrypt will remove all created artifacts such as dropped executables.

GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.

Gomir deletes its original executable and terminates its original process after creating a systemd service.

Aria-body has the ability to delete files and directories on compromised hosts.

BOLDMOVE can remove files on victim systems.

Crimson has the ability to delete files from a compromised host.

BADHATCH has the ability to delete PowerShell scripts from a compromised machine.

Once a file is uploaded, Machete will delete it from the machine.

After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.

Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.

ShrinkLocker can delete itself depending on various checks performed during execution.

Hildegard has deleted scripts after execution.

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.

ODAgent can delete payloads and files used to pass C2 commands from remotely hosted cloud accounts.

BlackByte 2.0 Ransomware deletes itself following device encryption.

FlawedAmmyy can execute batch scripts to delete files.

GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.

ProLock can remove files containing its payload after they are executed.

InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.

P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.

Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.

Volgmer can delete files and itself after infection to avoid analysis.

WhisperGate can delete tools from a compromised host after execution.

FruitFly will delete files on the system.

AcidPour includes a self-delete function where the malware deletes itself from disk after execution and program load into memory.

RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.

SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.

Raspberry Robin can delete its initial delivery script from disk during execution.

Fysbis has the ability to delete files.

VERMIN can delete files on the victim’s machine.

Nightdoor can self-delete.

HTTPTroy can terminate its running process and then remove traces of itself through the `die <COMMAND>` command.

PowerShower has the ability to remove all files created during the dropper process.

Kazuar can delete files.

FatDuke can secure delete its DLL.

zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.

Rising Sun can delete files and artifacts it creates.

ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.

Hi-Zor deletes its RAT installer file as it executes its DLL payload file.

XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.

Green Lambert can delete the original executable after initial installation in addition to unused functions.

LockerGoga has been observed deleting its original launcher after execution.

PUNCHBUGGY can delete files written to disk.

HyperBro has the ability to delete a specified file.

Anchor can self delete its dropper after the malware is successfully deployed.

Line Runner removes its initial ZIP delivery archive after processing the enclosed LUA script.

Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.

BeaverTail has deleted files from a compromised host after they were exfiltrated.

ROKRAT can request to delete files.