TrymeLocker Self-Deletion via cmd /c del or Batch Script Targeting Own Executable

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•1

Detects suspicious self-deletion patterns associated with TrymeLocker malware. This includes processes spawning cmd.exe to execute file deletion commands (cmd /c del) or the use of batch scripts to remove the originating process executable and subsequently delete themselves.