Windows 01flip Ransomware Self Deletion

Tim Peck@timpeck

•updated Dec 10, 2025•0•67

Detects a sequence of commands used by 01flip ransomware to delete itself from a Windows host after encryption. This involves using fsutil to zero out the file, and using the del command to delete it.