Procedure examples

Epic has a command to delete a file from the machine.

LightNeuron has a function to delete files.

Cuba can use the command cmd.exe /c del to delete its artifacts from the system.

PureCrypter can execute a PowerShell command to self-delete.

DarkGate has deleted its staging directories.

NanHaiShu launches a script to delete their original decoy file to cover tracks.

LockBit 3.0 can delete itself from disk.

Carbanak has a command to delete files.

Hydraq creates a backdoor through which remote attackers can delete files.

Ferocious can delete files from a compromised host.

Elise is capable of launching a remote shell on the host to delete itself.

Gazer has commands to delete files and persistence mechanisms from the victim.

Latrodectus has the ability to delete itself.

Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.

Pay2Key can remove its log file from disk.

LODEINFO can delete files to remove traces of activity from victim systems.

CharmPower can delete created files from a compromised system.

TYPEFRAME can delete files off the system.

Mori can delete its DLL file and related files by Registry value.

QUADAGENT has a command to delete its Registry key and scheduled task.

TAINTEDSCRIBE can delete files from a compromised host.

pngdowner deletes content from C2 communications that was saved to the user's temporary directory.

Uroburos can run a `Clear Agents Track` command on an infected machine to delete Uroburos-related logs.

Metamorfo has deleted itself from the system after execution.

Embargo has leveraged MDeployer to terminate the MS4Killer process, delete the decrypted payload files and a driver file dropped by MS4killer, and reboot the system.

Trojan.Karagany has used plugins with a self-delete capability.

Bandook has a command to delete a file.

MagicRAT can delete files on victim systems, including itself.

KONNI can delete files.

gh0st RAT has the capability to to delete files.

The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.

BLUELIGHT can uninstall itself.

Ixeshe has a command to delete a file from the machine.

VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%\..\Local\Temporary Internet Files\Content.Word and %APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\.

After initial setup, BPFDoor's original execution process deletes the dropped binary and exits.

StoneDrill has been observed deleting the temporary files once they fulfill their task.

OopsIE has the capability to delete files and scripts from the victim's machine.

Attor’s plugin deletes the collected files and log files after exfiltration.

SQLRat has used been observed deleting scripts once used.

SDBbot has the ability to delete files from a compromised host.

Mosquito deletes files using DeleteFileW API call.

RTM can delete all files created during its execution.

Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.

Grandoreiro can delete .LNK files created in the Startup folder.

LiteDuke can securely delete files by first writing random data to the file.

Some Sakula samples use cmd.exe to delete temporary files.

Sibot will delete itself if a certain server response is received.

WINDSHIELD is capable of file deletion along with other file system interaction.

Drovorub can delete specific files from a compromised host.

Shark can delete files downloaded to the compromised host.