{
  "family": "slefdel",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Trojan:Win32/Slefdel is a heuristic detection identifying a specific, evasive behavior common in malware droppers and initial stagers: self-deletion (`T1070.004`). This is not a specific malware family, but a tactical indicator. The malware executes, performs its primary function (usually downloading or extracting a much larger, stealthier payload), and then permanently deletes its own original executable file from the disk to eliminate the primary forensic artifact.<br><br><b>Understanding Slefdel (Self-Deleting Droppers)</b><br>To an end-user, this action is entirely invisible. For an incident responder, discovering a Slefdel alert means the initial infection vector is gone. The attacker successfully dropped a payload and then burned the bridge behind them. This requires immediate EDR analysis to determine *what* the deleted file actually did before it vanished.<br><br><b>Execution and Evasion Mechanics</b><br>Slefdel behavior is typically implemented in the initial dropper (often delivered via phishing - `T1566.001`). Upon execution, the dropper extracts the true malware payload (e.g., a banking trojan or ransomware) into memory or a hidden directory (`T1105`). To delete itself while it is still running (which Windows normally prevents), the malware uses API tricks. A common method is spawning a hidden command shell (`cmd.exe`) with a brief timeout (`ping 127.0.0.1`), instructing it to delete the dropper executable (`del /f /q`) immediately after the dropper process terminates. This leaves the victim machine infected with the payload, but the original dropped file is missing, frustrating traditional file-based AV scanning.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the secondary payload that was dropped. The primary IoC is the EDR alert flagging the self-deletion technique. Host-based IoCs require analyzing process trees: look for an initial suspicious executable (often in `%Temp%` or `Downloads`) that spawns `cmd.exe` passing the `/c del` command targeting its own file path. Network IoCs involve identifying any outbound connections made by that initial executable *before* it deleted itself.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1070.004",
    "T1059.003",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1070.004",
      "name": "Indicator Removal on Host: File Deletion (The core self-deletion behavior)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Using cmd.exe to execute the deletion)",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (The action performed before deletion)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the self-deletion indicates a successful drop of a secondary, likely more dangerous, payload.",
    "Analyze EDR process telemetry meticulously to identify the exact actions taken by the file *before* it spawned the deletion command.",
    "Hunt for newly created files or anomalous registry keys (autostarts) created around the exact timestamp of the self-deletion event.",
    "If possible, recover the deleted dropper executable from volume shadow copies or network packet captures for reverse engineering."
  ],
  "what_to_avoid": [
    "Do not assume the threat is mitigated just because the AV scanner says the file is 'removed' or 'not found'; the malware deleted itself on purpose.",
    "Avoid rebooting the machine immediately, as you may lose critical volatile memory containing the *actual* running payload."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}