Prinz Eugen Ransomware ping-delay self-deletion of servertool.exe

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•7

Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1 -n 2' followed by 'del /F /Q servertool.exe'. This sequence suggests an attempt to delay and then forcefully delete a file named 'servertool.exe', which could be indicative of malware self-deletion or an attacker cleaning up traces.