Supper Backdoor Self-Deletion Pattern (Interlock/Rhysida)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•3•1•17

Detects the self-deletion pattern used by the Supper backdoor, which involves a specific 'ping' command delay structure followed by a 'Del /f /q' command to remove itself from disk after execution. This pattern has been associated with Interlock and Rhysida ransomware.