Batch script self-deletion via cmd ping delay and del %~f0 (RareWolf dropper)

Subhankar H@Andrewsec57

•updated yesterday•0•0•1

Detects cmd.exe executing a ping-based delay to loopback followed by self-deletion of the batch script (%~f0), as well as bulk deletion of common archive and executable files, typically associated with malware droppers like RareWolf.