mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
3.1 KiB
3.1 KiB
| ID | C0047 |
| Objective(s) | File System |
| Related ATT&CK Techniques | None |
| Version | 2.0 |
| Created | 4 December 2020 |
| Last Modified | 13 September 2023 |
Delete File
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Dark Comet | 2008 | -- | Dark Comet deletes files. [1] |
| Gamut | 2014 | -- | Gamut deletes files. [1] |
| GoBotKR | 2019 | -- | GoBotKR deletes files. [1] |
| GravityRAT | 2018 | -- | GravityRAT deletes files. [1] |
| Hupigon | 2013 | -- | Hupigon deletes files. [1] |
| Kovter | 2016 | -- | Kovter deletes files. [1] |
| Mebromi | 2011 | -- | Mebromi deletes files. [1] |
| Redhip | 2011 | -- | Redhip deletes files. [1] |
| Rombertik | 2015 | -- | Rombertik deletes files. [1] |
| SamSam | 2015 | -- | SamSam deletes files. [1] |
| Shamoon | 2012 | -- | Shamoon deletes files. [1] |
| Stuxnet | 2010 | -- | Stuxnet deletes files. [1] |
| UP007 | 2016 | -- | UP007 deletes files. [1] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| delete file | Delete File (C0047) | kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| clears_logs | Delete File (C0047) | -- |
| removes_zoneid_ads | Delete File (C0047) | DeleteFileW, DeleteFileA |
| ransomware_recyclebin | Delete File (C0047) | -- |
| trickbot_task_delete | Delete File (C0047) | DeleteFileW |
| anomalous_deletefile | Delete File (C0047) | NtDeleteFile, DeleteFileW, DeleteFileA |
| deletes_self | Delete File (C0047) | NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW |
References
[1] capa v4.0, analyzed at MITRE on 10/12/2022