Deletion of ffox_* Temporary Staging Directory (WEES Stealer Anti-Forensics)

Subhankar H@Andrewsec57

•updated Jul 3, 2026•0•0•1

Detects the deletion of files within the 'Temp\ffox_' directory on Windows systems, a behavior associated with the WEES stealer malware for anti-forensics during the cleanup of staged exfiltration data.