Amadey Loader Persistence via Scheduled Task from e079729711 Directory

Ethan Andrews@eandrews

•updated Jun 24, 2026•0•0•1

Detects StealC's characteristic self-deletion pattern where cmd.exe executes a timeout delay followed by a forced quiet file deletion (/f /q) of the malware binary. This occurs as StealC's final operation after data exfiltration when the self_delete flag is set in the C2 configuration.