PAPERMILL Loader Decrypts LIBCURL.DAT via Donut Shellcode Staging

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•1

Detects activity where potential staging files (e.g., .dat or .dll files with specific naming patterns) are created or accessed within suspicious directories like AppData or RuntimeBroker folders, followed by the execution or loading of 'libcurl.dll'. This pattern is indicative of a loader or malware component staging its payload before using a network library to communicate with an external server.