Kimsuky JSE Loader Self-Deletion from Downloads Folder

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects the deletion of a .jse file from the user's Downloads directory by Windows Script Host (wscript.exe or cscript.exe). This behavior is consistent with the NUKESPED loader's anti-forensic cleanup routine, where the initial dropper deletes itself after staging subsequent payloads in secondary locations like ProgramData.