Procedure examples

RunningRAT contains code to delete files from the victim’s machine.

Exbyte will self-delete if a hard-coded configuration file is not found.

DarkWatchman has been observed deleting its original launcher after installation.

BBSRAT can delete files and directories.

PlugX has the remove itself and other artifacts.

Reaver deletes the original dropped file from the victim.

Bisonal will delete its dropper and VBS scripts from the victim’s machine.

MultiLayer Wiper uses a batch file, remover.bat to delete malware artifacts and the batch file itself during execution.

NOOPLDR can delete a file containing configuration instructions after use.

S-Type has deleted files it has created on a compromised host.

SeaDuke can securely delete files, including deleting itself from the victim.

DustySky can delete files it creates from the infected system.

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.

Epic has a command to delete a file from the machine.

LightNeuron has a function to delete files.

Cuba can use the command cmd.exe /c del to delete its artifacts from the system.

PureCrypter can execute a PowerShell command to self-delete.

DarkGate has deleted its staging directories.

NanHaiShu launches a script to delete their original decoy file to cover tracks.

LockBit 3.0 can delete itself from disk.

Carbanak has a command to delete files.

Hydraq creates a backdoor through which remote attackers can delete files.

Ferocious can delete files from a compromised host.

Elise is capable of launching a remote shell on the host to delete itself.

Gazer has commands to delete files and persistence mechanisms from the victim.

Latrodectus has the ability to delete itself.

Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.

Pay2Key can remove its log file from disk.

LODEINFO can delete files to remove traces of activity from victim systems.

CharmPower can delete created files from a compromised system.

TYPEFRAME can delete files off the system.

Mori can delete its DLL file and related files by Registry value.

QUADAGENT has a command to delete its Registry key and scheduled task.

TAINTEDSCRIBE can delete files from a compromised host.

pngdowner deletes content from C2 communications that was saved to the user's temporary directory.

Uroburos can run a `Clear Agents Track` command on an infected machine to delete Uroburos-related logs.

Metamorfo has deleted itself from the system after execution.

Embargo has leveraged MDeployer to terminate the MS4Killer process, delete the decrypted payload files and a driver file dropped by MS4killer, and reboot the system.

Trojan.Karagany has used plugins with a self-delete capability.

Bandook has a command to delete a file.

MagicRAT can delete files on victim systems, including itself.

KONNI can delete files.

gh0st RAT has the capability to to delete files.

The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.

BLUELIGHT can uninstall itself.

Ixeshe has a command to delete a file from the machine.

VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%\..\Local\Temporary Internet Files\Content.Word and %APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\.

After initial setup, BPFDoor's original execution process deletes the dropped binary and exits.

StoneDrill has been observed deleting the temporary files once they fulfill their task.

OopsIE has the capability to delete files and scripts from the victim's machine.