Loading malware…
Donut is an open-source position-independent shellcode generator and in-memory loader, rather than a self-contained malware family. It converts native executables, DLLs, .NET assemblies, and supported script payloads into shellcode that can load and execute payloads from memory. Donut supports reflective/manual loading workflows, including reconstruction of embedded binaries in memory, and can host the .NET CLR to execute managed assemblies without a conventional on-disk deployment. It has been widely incorporated into Windows malware delivery chains as an execution component, including by loaders, remote-access trojans, stealers, and supply-chain malware. Observed malicious implementations have used Donut-generated shellcode alongside process injection and memory-resident execution to reduce disk artifacts. Some Donut-based loader configurations have also been used to tamper with AMSI, WLDP, and ETW functions, although such behavior depends on the invoking implementation and configuration. Donut itself has no inherent delivery vector or exclusive threat-actor attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The IMG disk image contained an executable and malicious DLL that leveraged DLL sideloading to execute Donut Loader and ultimately install PackClient.
The malware stands out for its heavy use of advanced defense evasion methods, including NTDLL unhooking, direct syscalls via the Bouncy Gate technique, ETW patching, and reflective loading using the Donut shellcode.
The loader decrypts an AES-wrapped payload stored on disk. The decrypted payload contains a Donut shellcode loader that embeds the final RAT and uses Chaskey block cipher as part of its payload protection scheme. Donut then decrypts the final 32-bit native RAT, maps it, and executes it in memory.
While they still leverage classic droppers like PureCrypter and Rust-based loaders running Donut shellcode, they have added a potent new tool to their arsenal: PowerLoader.
Donut is an opensource position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files, and dotNET assemblies. In this attack, Donut is used to decrypt and execute the Atlantida stealer inside RegAsm.exe process memory.
This decrypted payload is Donut (aka DonutLoader, aka donut_injector) shellcode – an open-source, in-memory loader.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The VBScript initiates the PowerShell process and retrieves the next stage PowerShell script. The PowerShell script downloads the next stage payload from the attackers C2 server.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
Instead of calling high-level Windows APIs... the loader uses direct syscalls to perform sensitive memory operations.
The loader first attempts deployment into the primary target process (explorer.exe)... opens the target process using OpenProcess(), allocates executable memory... writes the recovered Donut shellcode using WriteProcessMemory(), and initiates execution through CreateRemoteThread().
Following successful shellcode execution within explorer.exe, a managed .NET payload was identified in the injected process memory and recovered as Yzebkhinuo.dll...
6 couches de déchiffrement : faux JPEG ... XOR ... Donut ... aPLib
The loader first attempts deployment into the primary target process (explorer.exe)... opens the target process using OpenProcess(), allocates executable memory... writes the recovered Donut shellcode using WriteProcessMemory(), and initiates execution through CreateRemoteThread().
Following successful shellcode execution within explorer.exe, a managed .NET payload was identified in the injected process memory and recovered as Yzebkhinuo.dll...
The ne.py Python script is used for Polymorphic Asynchronous Procedure Call (APC) Injection... defaults to injecting into the explorer.exe process if no parameter is provided.
The malware patches this function by overwriting the first byte with the opcode 0xC3 (a RET instruction). This simple patch effectively disables ETW telemetry, preventing security tools from receiving critical events and creating a significant blind spot for defenders and incident responders.
CHRDを起点として断片化データをシェルコードへ変換し、.NETローダーはPayloadSource.zipをTripleDES-CBCで復号してGZip展開する。
the user is immediately presented with a fake CAPTCHA verification instructions. The instructions trick the user into performing a specific sequence of clicks that ultimately spawn the MSHTA process and executes a malicious script.
The payload actively scans the infected machine for various indicators that could reveal the presence of a debugging tools, or sandboxed environment(Ex: machine configurations, graphics/display adapters etc).
To evade detection and reduce security visibility, the malware employs process injection, dynamic Application Programming Interface (API) resolution, Antimalware Scan Interface (AMSI) bypass, Event Tracing for Windows (ETW) tampering, and memory-resident execution techniques.
It then actively searches for the following debugging tools/ Virtual machine processes by enumerating running processes and matching names/hashes.
79 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
91 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used in TA4922's India-focused infection chain; malicious DLL sideloading executes it before PackClient installation.
Offensive framework used as one layer in PINHOLE’s multi-stage decryption and shellcode delivery chain.
An open-source shellcode generator/loader framework used within PINHOLE's later-stage unpacking and execution chain to initialize and run the final payload.
An open-source shellcode generation framework used here to create the position-independent shellcode contained in new.bin that ultimately delivers AsyncRAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.