Procedure examples

Bazar can delete its loader using a batch file in the Windows temporary folder.

Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk.

XLoader can delete malicious executables from compromised machines.

MoonWind can delete itself or specified files.

Cryptoistic has the ability delete files from a compromised host.

HermeticWiper has the ability to overwrite its own file with random bites.

Pysa has deleted batch files after execution.

ccf32 can delete files and folders from compromised machines.

LockBit 2.0 can delete itself from disk after execution.

Zebrocy has a command to delete files and directories.

SpeakUp deletes files to remove evidence on the machine.

LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one.

SUNBURST had a command to delete files.

EvilBunny has deleted the initial dropper after running through the environment checks.

Wingbird deletes its payload along with the payload's parent process after it finishes copying files.

HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.

ServHelper has a module to delete itself from the infected machine.

REvil can mark its binary code for deletion after reboot.

Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.

USBStealer has several commands to delete files associated with the malware from the victim.

OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.

Taidoor can use DeleteFileA to remove files from infected hosts.

Recent versions of Cherry Picker delete files and registry keys created by the malware.

Kivars has the ability to uninstall malware from the infected host.

Seasalt has a command to delete a specified file.

PLEAD has the ability to delete files on the compromised host.

Raccoon Stealer can remove files related to use and installation.

IPsec Helper can delete itself when given the appropriate command.

TRAILBLAZE has the ability to delete temporary files and contents in specified directories to cover its tracks.

Cardinal RAT can uninstall itself, including deleting its executable.

DanBot can delete its configuration file after installation.

Calisto has the capability to use rm -rf to remove folders and files from the victim's machine.

Solar has the ability to delete staged files after they are uploaded to C2.

GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.

Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.

Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe.

MacMa can delete itself from the compromised computer.

FunnyDream can delete files including its dropper component.

ROADSWEEP can use embedded scripts to remove itself from the infected host.

Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library.

More_eggs can remove itself from a system.

SysUpdate can delete its configuration file from the targeted system.

OutSteel can delete itself following the successful execution of a follow-on payload.

BackConfig has the ability to remove files and folders related to previous infections.

Proton removes all files in the /tmp directory.

InnaputRAT has a command to delete files.

GrimAgent can delete old binaries on a compromised host.

LookBack removes itself after execution and can delete files on the system.

Lokibot will delete its dropped files after bypassing UAC.

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.