certutil
MITRE ATT&CK: S0160 View on attack.mitre.org
Aliases: certutil.exe, certutil
- Malware type
- downloader, trojan
- Operating systems
- windows
- Related IoCs
- 2 (1 malicious)
- Last IoC activity
- 2026-10-15 11:57:58
- Profile updated
- 2026-07-07 15:32:21
Context
certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services.
Recent IoC activity
1 malicious indicator in Maltiverse are attributed to certutil (S0160). The 1 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 32_64_ver_2_bit.exe | 2026-09-15 | 1 |
Detection coverage
- 2 YARA rules
- 107 Sigma rules
Malware & tools used
- Archive via Utility (attack-pattern)
- Install Root Certificate (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
Used by threat actors
- APT41 DUST (campaign)
- 2025 Poland Wiper Attacks (campaign)
- Threat Group-3390 (threat-actor)
- Lotus Blossom (threat-actor)
- Earth Lusca (threat-actor)
- Medusa Group (threat-actor)
- Volt Typhoon (threat-actor)
- Turla (threat-actor)
- APT28 (threat-actor)
- APT41 (threat-actor)
- menuPass (threat-actor)
- Kimsuky (threat-actor)
- OilRig (threat-actor)
- Rancor (threat-actor)
- FIN13 (threat-actor)
- Higaisa (threat-actor)
Detection rules
- DITEKSHEN_INDICATOR_OLE_Metadatacmd (yara-rule)
- DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader (yara-rule)
Reports & references
- MITRE ATT&CK — S0160 (report)
- Microsoft — Cc732443 (report)