It may not have deleted itself for a few reasons. Additionally, it could have deleted itself and then be re-added by one of the attacker’s scripts to do more cleanup.
If you stat the file and it shows that it was created on the 21st but last modified on the 26th, it was mostly like touched or re-added by the attacker. If it shows the file was added on the 21st but was only accessed on the 26th (not modified) it probably didn’t delete itself due to a permissions issue or not completing fully when it ran but it keeps trying to run.