Kimsuky/JFMBackdoor Malware Self-Deletion of Components from TEMP via cmd.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the deletion of executable or script files (e.g., .dll, .exe, .bat, .jse) from temporary directories using common command-line utilities like cmd.exe or scripting hosts. This behavior is often associated with malware (such as Kimsuky loaders or JFMBackdoor) attempting to remove dropped artifacts to evade forensic analysis.