lowmanio.co.uk title image

Articles with the tag: self deletion

Self deleting malware

Mon, 03 Mar 2014 09:56PM

Have you ever wondered how some malware variants are able to delete themselves? A malicious executable is launched on a machine, and once launched in memory, the executable vanishes. This makes malware analysis very hard if no memory dump was taken, as there is seemingly nothing there. We can however use other artefacts to confirm the running of a non-existent file, such as by looking at the Prefetch files, User Assist files and certain registry entries.

Read full article