File Deletion

APT18 actors deleted tools and batch files from victim systems.

APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.

APT29 has used SDelete to remove artifacts from victim networks.

APT3 has a tool that can delete files.

APT32's macOS backdoor can receive a “delete” command.

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.

APT39 has used malware to delete files after they are deployed on a compromised host.

APT41 deleted files from the system.

AcidPour includes a self-delete function where the malware deletes itself from disk after execution and program load into memory.

ADVSTORESHELL can delete files and directories.

Anchor can self delete its dropper after the malware is successfully deployed.

Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.

AppleJeus has deleted the MSI file after installation.

AppleSeed can delete files from a compromised host after they are exfiltrated.

Aria-body has the ability to delete files and directories on compromised hosts.

Attor’s plugin deletes the collected files and log files after exfiltration.

During the 2015 Ukraine Electric Power Attack, vba_macro.exe deletes itself after `FONTCACHE.DAT`, `rundll32.exe`, and the associated .lnk file is delivered.

APT41 DUST deleted various artifacts from victim systems following use.

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.

During the C0032 campaign, TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.

During Cutting Edge, threat actors deleted `/tmp/test1.txt` on compromised Ivanti Connect Secure VPNs which was used to hold stolen configuration and cache files.

KV Botnet Activity removes on-disk copies of tools and other artifacts after it the primary botnet payload has been loaded into memory on the victim device.

During Operation AkaiRyū, MirrorFace deleted delivered tools and files from compromised hosts.

During Operation Digital Eye, threat actors deleted files delivered to compromised hosts, often named with the pattern do.* such as do.exe.