Pony Self-Deletion via cmd.exe del /F /Q and Batch Script Cleanup

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects common self-deletion patterns used by Pony malware, including the use of 'cmd.exe' with 'del /f' targeting executables in temporary or application data directories, batch file self-deletion loops, and PowerShell 'Remove-Item' or '[System.IO.File]::Delete()' targeting its own image path.