Process deleting its own executable shortly after network activity (stealer)

ills3c Intel&Coffee@Ills3C

•updated yesterday•23•0•20

Detects behavior where a process initiates an outbound public network connection and shortly afterwards deletes its own executable file from user-writable directories, a technique commonly associated with malware cleanup such as info-stealers.