Procedure examples

Misdat is capable of deleting Registry keys used for persistence.

Raspberry Robin uses a RunOnce Registry key for persistence, where the key is removed after its use on reboot then re-added by the malware after it resumes execution.

SplatDropper has deleted its malicious payload and removed its own created service to avoid leaving traces of its presence on victim devices.

PlugX has deleted registry keys that store data and maintained persistence.

S-Type has deleted accounts it has created.

RTM has the ability to remove Registry entries that it created for persistence.

Bazar's loader can delete scheduled tasks created by a previous instance of the malware.

Kapeka will clear registry values used for persistent configuration storage when uninstalled.

SUNBURST removed IFEO registry values to clean up traces of persistence.

IPsec Helper can delete various service traces related to persistent execution when commanded.

Pillowmint can uninstall the malicious service from an infected machine.

GrimAgent can delete previously created tasks on a compromised host.

njRAT is capable of manipulating and deleting registry keys, including those used for persistence.

KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.

MCMD has the ability to remove set Registry Keys, including those used for persistence.