Prinz Eugen Ransomware ping-delay self-deletion of servertool.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the self-deletion behavior of the Prinz Eugen ransomware. The ransomware, identified by the filename 'servertool.exe', spawns a command shell to execute a ping command (as a delay mechanism) followed by a force-deletion command to remove itself from the disk after encryption activities are complete.