VBScript Dropper Deletes Staged ZIP After Extraction in Public Folder

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects the deletion of .zip files within the Public directory by VBScript or JScript interpreters (wscript.exe or cscript.exe). This pattern is often indicative of a malicious dropper or downloader that extracts a payload from a staged archive and subsequently removes the evidence to hinder analysis and forensics.