MalwareUsed by 1 actor

ejtest.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DoNot

By directly crafting a phase 2 POST request to the payload delivery endpoint with the correct malp= body format, the server responded with an HTTP 200 and delivered a second-stage DoNot group DLL payload with the internal name ejtest.dll (Stage 5).

via cyderes blogcyderes.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence2

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry

Persistence

1 technique

T1053.005Scheduled TaskEvidence2

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The shellcode executes in chained XOR-encoded stages, each fetching and decoding the next from the same C2 domain under rotating file extensions (.ico, .mp3, .doc) to blend with normal traffic.

T1036.005Match Legitimate Resource Name or LocationEvidence1

It creates a scheduled task disguised as a legitimate OneDrive process Task Name : OneDrive Reporting Task-S-1-5-21-1025909648-4285204302-2845685589-1001

T1070.004File DeletionEvidence1

After establishing persistence and completing its initial C2 registration, the DLL removes its original copy from disk using a time-delayed self-delete command.

T1140Deobfuscate/Decode Files or InformationEvidence1

The decode loop operates on each byte of the encoded payload by first applying a bitwise NOT, then XORing the result with the key 0x65.

Discovery

2 techniques

T1082System Information DiscoveryEvidence2

Before contacting the C2, the DLL collects a detailed system profile. It gathers CPU information, retrieves the OS version through RtlGetVersion, queries the username and computer name, and enumerates all installed software.

T1518Software DiscoveryEvidence1

The beacon data structure collecting CPU model, OS version, hostname, and installed software is consistent across both samples.

Collection

1 technique

T1005Data from Local SystemEvidence1

The complete data is then NULL-padded to the next 16-byte boundary, AES-CBC encrypted with the hardcoded key/IV, base64-encoded, and transmitted as the mopd POST parameter.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

The DLL communicates with its C2 over HTTPS (port 443) using the WinINet API.

T1105Ingress Tool TransferEvidence2

each fetching and decoding the next from the same C2 domain under rotating file extensions (.ico, .mp3, .doc) to blend with normal traffic.

T1573.001Symmetric CryptographyEvidence1

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry, profiles the host, and beacons to a secondary C2 over HTTPS using AES-128-CBC.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyderes blogNews

Jul 15, 2026

DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel

A live second-stage DoNot module retrieved from active C2 infrastructure. It uses WinINet-based HTTPS communication, AES-128-CBC encrypted beacons, modular payload download capability, and communicates with exessupdate[.]info using URI patterns consistent with prior DoNot tooling.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

ejtest.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DoNot

via cyderes blogcyderes.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence2

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry

Persistence

1 technique

T1053.005Scheduled TaskEvidence2

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The shellcode executes in chained XOR-encoded stages, each fetching and decoding the next from the same C2 domain under rotating file extensions (.ico, .mp3, .doc) to blend with normal traffic.

T1036.005Match Legitimate Resource Name or LocationEvidence1

It creates a scheduled task disguised as a legitimate OneDrive process Task Name : OneDrive Reporting Task-S-1-5-21-1025909648-4285204302-2845685589-1001

T1070.004File DeletionEvidence1

After establishing persistence and completing its initial C2 registration, the DLL removes its original copy from disk using a time-delayed self-delete command.

T1140Deobfuscate/Decode Files or InformationEvidence1

The decode loop operates on each byte of the encoded payload by first applying a bitwise NOT, then XORing the result with the key 0x65.

Discovery

2 techniques

T1082System Information DiscoveryEvidence2

T1518Software DiscoveryEvidence1

The beacon data structure collecting CPU model, OS version, hostname, and installed software is consistent across both samples.

Collection

1 technique

T1005Data from Local SystemEvidence1

The complete data is then NULL-padded to the next 16-byte boundary, AES-CBC encrypted with the hardcoded key/IV, base64-encoded, and transmitted as the mopd POST parameter.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

The DLL communicates with its C2 over HTTPS (port 443) using the WinINet API.

T1105Ingress Tool TransferEvidence2

each fetching and decoding the next from the same C2 domain under rotating file extensions (.ico, .mp3, .doc) to blend with normal traffic.

T1573.001Symmetric CryptographyEvidence1

The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry, profiles the host, and beacons to a secondary C2 over HTTPS using AES-128-CBC.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyderes blogNews

Jul 15, 2026

DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.