GreenBlood Ransomware Self-Deletion via cleanup_greenblood.bat

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects suspicious command-line activity involving 'cmd.exe' executing a batch file named 'cleanup_greenblood.bat' or other batch files from temporary directories with specific cleanup-related commands. This pattern is often associated with malware or post-exploitation cleanup activities.