Procedure examples

FunnyDream can delete files including its dropper component.

ROADSWEEP can use embedded scripts to remove itself from the infected host.

Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library.

More_eggs can remove itself from a system.

SysUpdate can delete its configuration file from the targeted system.

OutSteel can delete itself following the successful execution of a follow-on payload.

BackConfig has the ability to remove files and folders related to previous infections.

Proton removes all files in the /tmp directory.

InnaputRAT has a command to delete files.

GrimAgent can delete old binaries on a compromised host.

LookBack removes itself after execution and can delete files on the system.

Lokibot will delete its dropped files after bypassing UAC.

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.

StealBit can self-delete its executable file from the compromised system.

FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.

ZxShell can delete files from the system.

Penquin can delete downloaded executables after running them.

SPAWNCHIMERA has deleted generated files and folders from victim devices.

BabyShark has cleaned up all files associated with the secondary payload execution.

Winnti for Windows can delete the DLLs for its various components from a compromised host.

Troll Stealer creates and can execute a BAT script that will delete the malware.

BLACKCOFFEE has the capability to delete files.

Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.

njRAT is capable of deleting files.

IceApple can delete files and directories from targeted systems.

JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.

metaMain has deleted collected items after uploading the content to its C2 server.

Heyoka Backdoor has the ability to delete folders and files from a targeted system.

HTTPBrowser deletes its original installer file once installation is complete.

LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.

KillDisk has the ability to quit and delete itself.

Qilin can delete itself from infected hosts after execution.

AppleJeus has deleted the MSI file after installation.

Kevin can delete files created on the victim's machine.

Pasam creates a backdoor through which remote attackers can delete files.

POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.

ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207.

Linfo creates a backdoor through which remote attackers can delete files.

QakBot can delete folders and files including overwriting its executable with legitimate programs.

DOWNIISSA can delete files after download.

Hancitor has deleted files using the VBA kill function.

Gelsemium can delete its dropper component from the targeted system.

jRAT has a function to delete files from the victim’s machine.

The Komplex trojan supports file deletion.

Denis has a command to delete files from the victim’s machine.

MacSpy deletes any temporary files it creates

Dtrack can remove its persistence and delete itself.

LoudMiner deleted installation files after completion.

Azorult can delete files from victim machines.

ADVSTORESHELL can delete files and directories.