Pony Self-Deletion Batch Script Dropped to %TEMP% and Executed

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•5

Detects Pony malware dropping a self-deletion batch script into %TEMP% via ShellExecuteA, then executing it with cmd.exe. The batch loops using 'if exist %1 goto' until the loader file lock is released, deletes the loader, then deletes itself with 'del %0'. Correlates .bat file creation in TEMP with subsequent cmd.exe execution of that same file on the same device.