AsyncRAT - Command Handler Self-Delete Routine (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Identifies the execution of the ClientDelete command designed to wipe traces of the Realtek-disguised malware from the disk. Specifically, it looks for 'cmd.exe' executing a 'del' command with 'RealtekAudio' in the path, which is a known pattern for AsyncRAT self-deletion.