Anti-forensic cleanup
Named by 5 kept items in this workspace.
Search every workspace for Anti-forensic cleanup. It matches the name as written, so it can find other things that share it.
The items that name it 5
runner.ps1 terminates every wscript.exe/cscript.exe process and deletes the staging directory; 4.vbs deletes value.txt and map.txt after use.
Deletes staging files, lock directories, temp scripts (.kgrab.sh, .kpwd), the exfil archive, and reverts .zshrc after each stage completes to minimize on-disk evidence
MacSync attempted to cover its tracks by deleting the archive after exfiltration.
Shellcode restores original inetd.conf content after triggering the backdoor, and the backdoor is dropped in /var/run/ which does not survive reboot, to reduce forensic evidence and avoid persistence
Attackers observed deleting JAR files post-execution to prolong attacks and remain stealthy; autorun files are also auto-deleted after processing.
All techniques in this workspace.