Procedure examples

ODAgent can delete payloads and files used to pass C2 commands from remotely hosted cloud accounts.

BlackByte 2.0 Ransomware deletes itself following device encryption.

FlawedAmmyy can execute batch scripts to delete files.

GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.

ProLock can remove files containing its payload after they are executed.

InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.

P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.

Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.

Volgmer can delete files and itself after infection to avoid analysis.

WhisperGate can delete tools from a compromised host after execution.

FruitFly will delete files on the system.

AcidPour includes a self-delete function where the malware deletes itself from disk after execution and program load into memory.

RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.

SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.

Raspberry Robin can delete its initial delivery script from disk during execution.

Fysbis has the ability to delete files.

VERMIN can delete files on the victim’s machine.

Nightdoor can self-delete.

HTTPTroy can terminate its running process and then remove traces of itself through the `die <COMMAND>` command.

PowerShower has the ability to remove all files created during the dropper process.

Kazuar can delete files.

FatDuke can secure delete its DLL.

zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.

Rising Sun can delete files and artifacts it creates.

ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.

Hi-Zor deletes its RAT installer file as it executes its DLL payload file.

XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.

Green Lambert can delete the original executable after initial installation in addition to unused functions.

LockerGoga has been observed deleting its original launcher after execution.

PUNCHBUGGY can delete files written to disk.

HyperBro has the ability to delete a specified file.

Anchor can self delete its dropper after the malware is successfully deployed.

Line Runner removes its initial ZIP delivery archive after processing the enclosed LUA script.

Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.

BeaverTail has deleted files from a compromised host after they were exfiltrated.

ROKRAT can request to delete files.

RunningRAT contains code to delete files from the victim’s machine.

Exbyte will self-delete if a hard-coded configuration file is not found.

DarkWatchman has been observed deleting its original launcher after installation.

BBSRAT can delete files and directories.

PlugX has the remove itself and other artifacts.

Reaver deletes the original dropped file from the victim.

Bisonal will delete its dropper and VBS scripts from the victim’s machine.

MultiLayer Wiper uses a batch file, remover.bat to delete malware artifacts and the batch file itself during execution.

NOOPLDR can delete a file containing configuration instructions after use.

S-Type has deleted files it has created on a compromised host.

SeaDuke can securely delete files, including deleting itself from the victim.

DustySky can delete files it creates from the infected system.

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.