Procedure examples

StealBit can self-delete its executable file from the compromised system.

FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.

ZxShell can delete files from the system.

Penquin can delete downloaded executables after running them.

SPAWNCHIMERA has deleted generated files and folders from victim devices.

BabyShark has cleaned up all files associated with the secondary payload execution.

Winnti for Windows can delete the DLLs for its various components from a compromised host.

Troll Stealer creates and can execute a BAT script that will delete the malware.

BLACKCOFFEE has the capability to delete files.

Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.

njRAT is capable of deleting files.

IceApple can delete files and directories from targeted systems.

JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.

metaMain has deleted collected items after uploading the content to its C2 server.

Heyoka Backdoor has the ability to delete folders and files from a targeted system.

HTTPBrowser deletes its original installer file once installation is complete.

LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.

KillDisk has the ability to quit and delete itself.

Qilin can delete itself from infected hosts after execution.

AppleJeus has deleted the MSI file after installation.

Kevin can delete files created on the victim's machine.

Pasam creates a backdoor through which remote attackers can delete files.

POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.

ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207.

Linfo creates a backdoor through which remote attackers can delete files.

QakBot can delete folders and files including overwriting its executable with legitimate programs.

DOWNIISSA can delete files after download.

Hancitor has deleted files using the VBA kill function.

Gelsemium can delete its dropper component from the targeted system.

jRAT has a function to delete files from the victim’s machine.

The Komplex trojan supports file deletion.

Denis has a command to delete files from the victim’s machine.

MacSpy deletes any temporary files it creates

Dtrack can remove its persistence and delete itself.

LoudMiner deleted installation files after completion.

Azorult can delete files from victim machines.

ADVSTORESHELL can delete files and directories.

StrifeWater can self delete to cover its tracks.

SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.

FALLCHILL can delete malware and associated artifacts from the victim.

SILENTTRINITY can remove files from the compromised host.

PcShare has deleted its files and components from a compromised host.

CSPY Downloader has the ability to self delete.

Remcos can delete files and folders from victim machines.

Imminent Monitor has deleted files related to its dynamic debugger feature.

cmd can be used to delete files from the file system.

SDelete deletes data in a way that makes it unrecoverable.

TeamPCP Cloud Stealer has the ability to remove all staged files after exfiltration.

Mini Shai-Hulud has deleted all artifacts to include gathered credential archives to reduce disk persistence and detection.

CanisterWorm has deleted itself after execution.