01flip Ransomware Self-Deletion on Linux

Mehulkumar Savajani@Msavajani

•updated Dec 18, 2025•7•1•74

Detects the specific command-line sequence used by the 01flip ransomware on Linux to erase itself from the disk after encrypting files. This involves using 'sleep' for a delay, 'dd' to overwrite the file with random data, and 'rm' to delete it.