StealC Self-Deletion via cmd.exe timeout and del After Exfiltration

Ethan Andrews@eandrews

•updated Jun 24, 2026•0•0•2

Detects StealC's characteristic self-deletion pattern where cmd.exe executes a timeout delay followed by a forced quiet file deletion (/f /q) of the malware binary. This occurs as StealC's final operation after data exfiltration when the self_delete flag is set in the C2 configuration.