Loading malware…
Donut is an open-source shellcode-generation and in-memory loading tool used in both legitimate security testing and malicious infection chains on Windows. It generates position-independent shellcode capable of loading and executing .NET assemblies, native executables, DLLs, VBScript, and JScript in memory. For managed payloads, it can use the Unmanaged CLR Hosting API to initialize the Common Language Runtime, create an application domain, load an assembly, and invoke its entry point. Its payload encryption and in-memory execution reduce exposed executable structures and the need to write decrypted payloads to disk. The project also includes a shellcode-injection component for executing payloads inside another process.
Attackers embed Donut-generated shellcode in multistage loaders implemented with PowerShell, .NET, AutoIt, Lua, and other technologies. Observed delivery chains include phishing attachments and links, spearphishing, and ClickFix social engineering. Donut has been used to load remote-access trojans and information stealers including ValleyRAT, VenomRAT, Atlantida, Phemedrone, and Remus. Void Banshee used it in a campaign exploiting CVE-2024-38112 to execute Atlantida within a legitimate Windows process. Donut is a reusable execution component rather than a threat-actor-specific implant; credential theft, surveillance, persistence, and command-and-control functionality depend on the surrounding loaders and final payloads.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this attack, Donut is used to decrypt and execute the Atlantida stealer inside RegAsm.exe process memory.
It then uses a Donut shellcode loader to run a .NET payload in memory.
“The obtained shellcode is in fact Donut Loader ... that contains a non-obfuscated pinkman agent binary.”
The IMG disk image contained an executable and malicious DLL that leveraged DLL sideloading to execute Donut Loader and ultimately install PackClient.
The malware stands out for its heavy use of advanced defense evasion methods, including NTDLL unhooking, direct syscalls via the Bouncy Gate technique, ETW patching, and reflective loading using the Donut shellcode.
The loader decrypts an AES-wrapped payload stored on disk. The decrypted payload contains a Donut shellcode loader that embeds the final RAT and uses Chaskey block cipher as part of its payload protection scheme. Donut then decrypts the final 32-bit native RAT, maps it, and executes it in memory.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims are lured to spam/malicious websites via Malvertising , Phishing and Compromised / hacked legitimate websites.
Emails delivered ZIP archives containing IMG disk images; mounted images contained an executable and malicious DLL.
The VBScript initiates the PowerShell process and retrieves the next stage PowerShell script. The PowerShell script downloads the next stage payload from the attackers C2 server.
The downloaded installer is pre-bundled with AutoIt3.exe, which drops and loads an .au3 script from the same folder location.
apc_run_payload – the APC callback that eventually executes the decrypted shellcode... The APC callback is responsible for executing the decrypted payload in memory.
Donut ... is a public position-independent code generator and in-memory loader... the Donut-derived code reconstructs the native PE, resolves imports, applies relocations... without requiring the final PE to be created as a normal file on disk.
The malware uses the CreateProcess Windows API to launch RegAsm.exe in a suspended state.
The extracted shellcode is injected into the same AutoIt process.
The ne.py Python script is used for Polymorphic Asynchronous Procedure Call (APC) Injection... defaults to injecting into the explorer.exe process if no parameter is provided.
The embedded JavaScript loader is using an indexed string table to dynamically resolve property names.
"The Python script hands off to shellcode generated by Thewover's Donut ... a tool that wraps arbitrary executables or .NET assemblies into position-independent x86-64 shellcode."
The actor in this incident compiled the cryptominer directly on the endpoint... Silent XMR Miner Builder.exe ... executed several .NET Framework utilities and an array of C compilers.
DLLの.rsrcセクションには175個のRCDATAリソースが格納され、シェルコードの断片と大量のダミーデータが含まれる。
The malware uses the CreateProcess Windows API to launch RegAsm.exe in a suspended state.
The extracted shellcode is injected into the same AutoIt process.
The ne.py Python script is used for Polymorphic Asynchronous Procedure Call (APC) Injection... defaults to injecting into the explorer.exe process if no parameter is provided.
“La stringa Base64 viene decodificata a runtime dal .ps1.”
Atlantida abuses RegAsm.exe to proxy malicious code execution
The script calls CreateThread() and supplies the address returned by VirtualAlloc() as the thread start address.
The script calls IsDebuggerPresent and exits silently if a debugger is detected.
To evade detection and reduce security visibility, the malware employs process injection, dynamic Application Programming Interface (API) resolution, Antimalware Scan Interface (AMSI) bypass, Event Tracing for Windows (ETW) tampering, and memory-resident execution techniques.
AmsiScanBuffer is bypassed with hardware breakpoints and later patched process-wide.
It then actively searches for the following debugging tools/ Virtual machine processes by enumerating running processes and matching names/hashes.
The script calls IsDebuggerPresent and exits silently if a debugger is detected.
81 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
114 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Shellcode execution tooling used in a delivery chain involving PureCrypter and the eventual deployment of DarkVision.
A Donut loader serves as the intermediate stage in the third benchmark sample. A Go executable contains an AES-ECB-encrypted payload that yields the loader, which in turn contains ValleyRAT. Malcat's built-in Donut unpacker supported recovery of the final payload.
An intermediate loader in the third benchmark sample. AES-ECB decryption of data embedded in a Go executable reveals Donut, which can then be unpacked to recover ValleyRAT.
Offensive shellcode-generation and loading tool used to package the Remus Stealer DLL in this delivery chain. An AutoIt script decrypts the shellcode, copies it into dynamically allocated executable memory, and starts a thread at that address. The Donut-packed shellcode subsequently loads Remus Stealer within the AutoIt process.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.