Skip to Content

Del-fact.7z

Copy the file to a write-blocked forensic device. Compute its hash (SHA-256 preferred). Example:

sha256sum del-fact.7z > del-fact.7z.hash

Search your system logs for the exact creation time of del-fact.7z. Cross-reference with:

A common finding: del-fact.7z is created immediately after a large outbound data transfer to an unknown IP.

If you have legitimate reason to open a password-protected del-fact.7z but the password is lost: del-fact.7z

In computational statistics, factorial designs (often abbreviated "FACT") generate massive intermediate datasets. Some legacy SAS, R, or SPSS workflows on Windows HPC clusters were configured to archive intermediate results as del-fact.7z (where "del" stands for "delta" or "delimiter"). After the main analysis finishes, the archive should be auto-deleted. But in poorly managed shared computing environments, thousands of such files accumulate. This theory explains why del-fact.7z appears on university HPC clusters and bioinformatics servers.

If encryption is absent, extract within an isolated sandbox (e.g., Cuckoo, Joe Sandbox, FireEye AX). Monitor for:

If you're using Python, here's a simple example to extract the archive: Copy the file to a write-blocked forensic device

import subprocess
import os
def extract_7z_archive(archive_path, extract_path):
    if not os.path.exists(extract_path):
        os.makedirs(extract_path)
try:
        subprocess.run(f'7z x "archive_path" -o"extract_path"', check=True, shell=True)
        print("Extraction successful.")
    except subprocess.CalledProcessError as e:
        print(f"Extraction failed: e")
# Usage
archive_path = "path/to/del-fact.7z"
extract_path = "path/to/extract"
extract_7z_archive(archive_path, extract_path)

More alarmingly, multiple threat intelligence feeds (notably ReversingLabs and ANY.RUN) have flagged del-fact.7z as a recurring filename in living-off-the-land (LotL) attacks. Here’s how it works:

The name itself becomes a form of "conceptual camouflage"—an administrator seeing del-fact.7z might assume it’s old factorial benchmark data or a pending deletion marker, ignoring it.

del-fact.7z is not a virus, not a standard system file, and certainly not one to ignore. It represents a fascinating collision of three digital realities: human error (the accidental archive), adversarial tradecraft (the exfiltration container), and statistical computing legacy (the factorial relic). Search your system logs for the exact creation

If you find this file on your system, treat it like a black box — containing either factorial benchmarks, an admin’s forgotten logs, or the crown jewels of a breach. The only way to know is to handle it forensically, never by double-click.

And if you are the person who originally wrote that script that generates del-fact.7z on a production server—please, just use a timestamp. Future forensic analysts will thank you.

Further Reading & Tools:

Have you encountered del-fact.7z in the wild? Consider submitting a sample (password removed) to VirusTotal or Hybrid Analysis to help decode this persistent digital ghost.

1 min