value:  APT32's macOS backdoor can receive a “delete” command. ;; APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. ;; APT39 has used malware to delete files after they are deployed on a compromised host. ;; APT41 deleted files from the system. ;; Aria-body has the ability to delete files and directories on compromised hosts. ;; Attor’s plugin deletes the collected files and log files after exfiltration. ;; AuditCred can delete files from the system. ;; Azorult can delete files from victim machines. ;; BabyShark has cleaned up all files associated with the secondary payload execution. ;; BackConfig has the ability to remove files and folders related to previous infections. ;; Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim. ;; Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system. ;; Bazar can delete its loader using a batch file in the Windows temporary folder. ;; BBSRAT can delete files and directories. ;; Bisonal deletes its dropper and VBS scripts from the victim’s machine. ;; BLACKCOFFEE has the capability to delete files. ;; BLINDINGCAN has deleted itself and associated artifacts from victim machines. ;; The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated. ;; Calisto has the capability to use rm -rf to remove folders and files from the victim's machine. ;; Carbanak has a command to delete files. ;; Cardinal RAT can uninstall itself including deleting its executable. ;; CARROTBAT has the ability to delete downloaded files from a compromised host. ;; Recent versions of Cherry Picker delete files and registry keys created by the malware. ;; Chimera has performed file deletion to evade detection. ;; cmd can be used to delete files from the file system. ;; Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks. ;; Cryptoistic has the ability delete files from a compromised host. ;; CSPY Downloader has the ability to self delete. ;; Denis has a command to delete files from the victim’s machine. ;; Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes. ;; Dragonfly 2.0 deleted many of its files used during operations as part of cleanup including removing applications and deleting screenshots. ;; Drovorub can delete specific files from a compromised host. ;; Dtrack can remove its persistence and delete itself. ;; DustySky can delete files it creates from the infected system. ;; ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207. ;; Elise is capable of launching a remote shell on the host to delete itself. ;; Epic has a command to delete a file from the machine. ;; EvilBunny has deleted the initial dropper after running through the environment checks. ;; Evilnum has deleted files used during infection. ;; Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file. ;; FALLCHILL can delete malware and associated artifacts from the victim. ;; FatDuke can secure delete its DLL. ;; FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components. ;; FIN10 has used batch scripts and scheduled tasks to delete critical system files. ;; FIN5 uses SDelete to clean up the environment and attempt to prevent detection. ;; FIN6 has removed files from victim machines. ;; FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. ;; FruitFly will delete files on the system. ;; Fysbis has the ability to delete files. ;; Gamaredon Group tools can delete files used during an infection. ;; Gazer has commands to delete files and persistence mechanisms from the victim. ;; gh0st RAT has the capability to to delete files. ;; Gold Dragon deletes one of its files 2.hwp from the endpoint after establishing persistence. ;; GoldenSpy's uninstaller can delete registry entries files and folders and finally itself once these tasks have been completed. ;; Grandoreiro can delete .LNK files created in the Startup folder. ;; GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API. ;; Malware used by Group5 is capable of remotely deleting files from victims. ;; GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host. ;; HALFBAKED can delete a specified file. ;; Hancitor has deleted files using the VBA kill function. ;; HAWKBALL has the ability to delete files. ;; Hi-Zor deletes its RAT installer file as it executes its DLL payload file. ;; Hildegard has deleted scripts after execution. ;; Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection. ;; HotCroissant has the ability to clean up installed files delete files and delete itself from the victim’s machine. ;; HTTPBrowser deletes its original installer file once installation is complete. ;; Hydraq creates a backdoor through which remote attackers can delete files. ;; HyperBro has the ability to delete a specified file. ;; Imminent Monitor has deleted files related to its dynamic debugger feature. ;; InnaputRAT has a command to delete files. ;; InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers. ;; Ixeshe has a command to delete a file from the machine. ;; The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files. ;; JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running. ;; jRAT has a function to delete files from the victim’s machine. ;; Kazuar can delete files. ;; KEYMARBLE has the capability to delete files off the victim’s machine. ;; Kimsuky has deleted the exfiltrated data on disk after transmission. ;; Kivars has the ability to uninstall malware from the infected host. ;; The Komplex trojan supports file deletion. ;; KONNI can delete files. ;; Lazarus Group malware deletes files in various ways including suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim. ;; LightNeuron has a function to delete files. ;; Linfo creates a backdoor through which remote attackers can delete files. ;; LockerGoga has been observed deleting its original launcher after execution. ;; LookBack removes itself after execution and can delete files on the system. ;; LoudMiner deleted installation files after completion. ;; Once a file is uploaded Machete will delete it from the machine. ;; MacSpy deletes any temporary files it creates ;; Magic Hound has deleted and overwrote files to cover tracks. ;; A menuPass macro deletes files after it has decoded and decompressed them. ;; Once loaded into memory MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk. ;; Metamorfo has deleted itself from the system after execution. ;; Misdat is capable of deleting the backdoor file. ;; MoonWind can delete itself or specified files. ;; More_eggs can remove itself from a system. ;; Mosquito deletes files using DeleteFileW API call. ;; MURKYTOP has the capability to delete local files. ;; Mustang Panda will delete their tools and files and kill processes after their objectives are reached. ;; NanHaiShu launches a script to delete their original decoy file to cover tracks. ;; NOKKI can delete files to cover tracks. ;; OceanSalt can delete files from the system. ;; OilRig has deleted files associated with their payload after execution. ;; Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers. ;; OopsIE has the capability to delete files and scripts from the victim's machine. ;; Operation Wocao has deleted logs and executable files used during an intrusion. ;; OSX_OCEANLOTUS.D has a command to delete a file from the system. ;; P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run. ;; Pasam creates a backdoor through which remote attackers can delete files. ;; Patchwork removed certain files and replaced them so they could not be retrieved. ;; Pay2Key can remove its log file from disk. ;; Penquin can delete downloaded executables after running them. ;; Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe. ;; PLEAD has the ability to delete files on the compromised host. ;; pngdowner deletes content from C2 communications that was saved to the user's temporary directory. ;; Pony has used scripts to delete itself after execution. ;; PowerDuke has a command to write random data across a file and delete it. ;; PowerShower has the ability to remove all files created during the dropper process. ;; POWERSTATS can delete all files on the C:\ D:\ E:\ and F:\ drives using PowerShell Remove-Item commands. ;; Proton removes all files in the /tmp directory. ;; Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file. ;; Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes. ;; PUNCHBUGGY can delete files written to disk. ;; Pysa has deleted batch files after execution.  ;; QUADAGENT has a command to delete its Registry key and scheduled task. ;; RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system. ;; RDFSNIFFER has the capability of deleting local files. ;; Reaver deletes the original dropped file from the victim. ;; RedLeaves can delete specified files. ;; Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data. ;; REvil can mark its binary code for deletion after reboot. ;; Rising Sun can delete files specified by the C2. ;; Rocke has deleted files on infected machines. ;; ROKRAT can request to delete files. ;; RTM can delete all files created during its execution. ;; RunningRAT contains code to delete files from the victim’s machine. ;; Some Sakula samples use cmd.exe to delete temporary files. ;; SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult. ;; Sandworm Team has used backdoors that can delete files used in an attack from an infected system. ;; SDBbot has the ability to delete files from a compromised host. ;; SDelete deletes data in a way that makes it unrecoverable. ;; SeaDuke can securely delete files including deleting itself from the victim. ;; Seasalt has a command to delete a specified file. ;; ServHelper has a module to delete itself from the infected machine. ;; ShimRat can uninstall itself from compromised hosts as well create and modify directories delete move copy and rename files. ;; Sibot will delete itself if a certain server response is received. ;; Silence has deleted artifacts including scheduled tasks communicates files from the C2 and other logs. ;; SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system. ;; SpeakUp deletes files to remove evidence on the machine. ;; SQLRat has used been observed deleting scripts once used. ;; StoneDrill has been observed deleting the temporary files once they fulfill their task. ;; StrongPity can delete previously exfiltrated files from the compromised host. ;; SUNBURST had a command to delete files. ;; Following the successful injection of SUNBURST SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library. ;; TAINTEDSCRIBE can delete files from a compromised host. ;; TDTESS creates then deletes log files during installation of itself as a service. ;; TEMP.Veles routinely deleted tools logs and other files after they were finished with them. ;; The White Company has the ability to delete its malware entirely from the target system. ;; Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim. ;; Trojan.Karagany has used plugins with a self-delete capability. ;; Tropic Trooper has deleted dropper files on an infected system using command scripts. ;; TYPEFRAME can delete files off the system. ;; UNC2452 routinely removed their tools including custom backdoors once remote access was achieved. ;; Ursnif has deleted data staged in tmp files after exfiltration. ;; USBStealer has several commands to delete files associated with the malware from the victim. ;; VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%..\Local\Temporary Internet Files\Content.Word and %APPDATA%..\Local Settings\Temporary Internet Files\Content.Word\. ;; VERMIN can delete files on the victim’s machine. ;; Volgmer can delete files and itself after infection to avoid analysis. ;; WINDSHIELD is capable of file deletion along with other file system interaction. ;; WindTail has the ability to receive and execute a self-delete command. ;; Wingbird deletes its payload along with the payload's parent process after it finishes copying files. ;; Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use. ;; XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method. ;; Zebrocy has a command to delete files and directories. ;; Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track. ;; zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots. ;; ZxShell can delete files from the system. "
name: Indicator Removal on Host: File Deletion