Skip to content

ricardojoserf/SharpSelfDelete

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 

Repository files navigation

SharpSelfDelete

This is a PoC code to self-delete a binary in C#. It is specially useful for malware as under normal conditions it is not possible to delete a binary on Windows while it is running. In my case I needed it for the SharpCovertTube project, so the binary can delete itself from disk.

It uses the APIs GetModuleFileName, CreateFileW and SetFileInformationByHandle to rename the Alternate Data Stream $DATA (the default one) in the binary to a random new one and then delete the file.

img

Source

This is a port from the code in a lesson of Maldev Academy, which was originally written in C.

Sponsor this project

Languages