Chronoss3 / SharpSelfDelete

PoC to self-delete a binary in C#

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

SharpSelfDelete

This is a PoC code to self-delete a binary in C#. It is specially useful for malware as under normal conditions it is not possible to delete a binary on Windows while it is running. In my case I needed it for the SharpCovertTube project, so the binary can delete itself from disk.

It uses the APIs GetModuleFileName, CreateFileW and SetFileInformationByHandle to rename the Alternate Data Stream $DATA (the default one) in the binary to a random new one and then delete the file.

img

Source

This is a port from the code in a lesson of Maldev Academy, which was originally written in C.

About

PoC to self-delete a binary in C#


Languages

Language:C# 100.0%