Kimsuky: certutil.exe copied/renamed and used to decode kid*.bat payload

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the suspicious copying of the Windows certutil.exe binary to an alternate location (e.g., /Users/Public/Downloads/) followed by execution with decoding or caching flags. This behavior is indicative of an adversary attempting to use certutil as a LOLBin to decode or reassemble malicious payloads, a tactic frequently observed in Kimsuky-related LNK malware campaigns.