Loading malware…
DonutLoader is an in-memory shellcode loader and shellcode-generation framework used to wrap PE files, DLLs, .NET assemblies, and scripts into position-independent shellcode for memory-resident execution on Windows. It is commonly used as a staging component rather than a final payload, enabling operators to launch second-stage malware with minimal disk artifacts and reduced exposure to file-based detection. Reported use cases include delivery of backdoors, remote access trojans, infostealers, and credential theft malware such as SPECTRALVIPER, PureRAT, ValleyRAT, Beagle, AgentTesla, StealC v2, CASTLESTEALER, and other commodity or custom payloads.
Operationally, DonutLoader is associated with process injection and in-memory unpacking or execution of embedded payloads, often inside trusted Windows processes. It has appeared in intrusion chains involving DLL sideloading, LOLBin abuse, script-based droppers, PowerShell staging, and multi-stage loaders. Observed campaigns have used it after phishing, malvertising, fake software installers, fake AI or developer-tool download pages, WhatsApp-delivered scripts, and ClickFix-style social engineering. In several cases it was embedded in or launched by obfuscated loaders, malicious DLLs, JavaScript or batch droppers, or trojanized installers, then used to inject or execute the final malware entirely in memory.
DonutLoader has been observed across both espionage and financially motivated operations. It has been used in activity overlapping with APT32/OceanLotus tradecraft to stage a Windows backdoor, in Silver Fox- and ValleyRAT-linked activity, in campaigns delivering LummaStealer and AgentTesla, and in malvertising operations distributing CASTLESTEALER and Beagle. Because it is open source and broadly reusable, its presence alone is not sufficient for attribution. Its primary significance is as a flexible Windows loader that supports stealthy post-exploitation by enabling memory-only execution, process injection, and defense evasion in diverse intrusion chains.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It does not travel alone: the same set deploys P8LOADER (an obfuscated x64 PE loader), POWERSEAL (a .NET PowerShell runner with built-in AMSI/ETW evasion) and DONUTLOADER shellcode used to stage the backdoor.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
...Velvet Tempest ... used a ClickFix lure ... to drop payloads like DonutLoader and CastleRAT.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
62[.]60[.]226[.]248 hosted the DonutLoader malware payload... a memory‑only loader that turns PE/.NET/DLL/script into shellcode and injects them into other processes.
MITRE ATT&CK Mapping Tactic Technique ID Application Execution PowerShell T1059.001 Invoke-WebRequest + Add-Type inline C#
The malware uses a staged execution chain that moves from Python bytecode into shellcode... The persisted Python bytecode stage contains loader indicators
DONUTLOADER injects into sessionmsg.exe; SPECTRALVIPER injects shellcode and PEs into processes.
MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads Defense Evasion Masquerading: Legitimate Name T1036.005 Process named nsvchost.exe Defense Evasion Subvert Trust Controls T1553 Inline C# avoids pre-compiled AV detection Privilege Escalation Token Manipulation T1134.001 SeDebugPrivilege via AdjustTokenPrivileges Discovery Process Discovery T1057 CreateToolhelp32Snapshot for svchost.exe Lateral Movement Process Injection: DLL Injection T1055.001 VirtualAllocEx + WriteProcessMemory into svchost.exe
The chain includes heavy obfuscation and encryption, runtime patching... The deobfuscation order observed for this stage is: base85 decode ↓ zlib decompress ↓ marshal.loads()
...extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2...
The dropped PE is not AgentTesla itself but a DonutLoader shellcode packer. DonutLoader unpacks and executes the AgentTesla binary entirely in memory, leaving no additional artifacts on disk beyond the initial dropper.
extracts DonutLoader, a shellcode loader, from a PNG image present within the binary
MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads
Attackers set up a convincing lookalike website to distribute a dangerous installer... The fake site, hosted at claude-pro[.]com, closely mirrors the look and feel of the real Claude website, using similar fonts and color schemes.
SysInternals ProcDump was renamed to windbg.exe and abused (-md) as a LOLBAS to load an unsigned malicious DLL.
DONUTLOADER injects into sessionmsg.exe; SPECTRALVIPER injects shellcode and PEs into processes.
MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads Defense Evasion Masquerading: Legitimate Name T1036.005 Process named nsvchost.exe Defense Evasion Subvert Trust Controls T1553 Inline C# avoids pre-compiled AV detection Privilege Escalation Token Manipulation T1134.001 SeDebugPrivilege via AdjustTokenPrivileges Discovery Process Discovery T1057 CreateToolhelp32Snapshot for svchost.exe Lateral Movement Process Injection: DLL Injection T1055.001 VirtualAllocEx + WriteProcessMemory into svchost.exe
The deobfuscation order observed for this stage is: base85 decode ↓ zlib decompress ↓ marshal.loads() ↓ Python loader execution
After dropping the PE payload to C:\Users\Public\Libraries\ , the dropper does not execute it directly. Instead, it invokes Scriptrunner.exe -appvscript <payload_path> , abusing the legitimate Microsoft App-V Scriptrunner binary as a Living-off-the-Land Binary (LOLBin).
The hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" ... to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads Defense Evasion Masquerading: Legitimate Name T1036.005 Process named nsvchost.exe Defense Evasion Subvert Trust Controls T1553 Inline C# avoids pre-compiled AV detection Privilege Escalation Token Manipulation T1134.001 SeDebugPrivilege via AdjustTokenPrivileges Discovery Process Discovery T1057 CreateToolhelp32Snapshot for svchost.exe Lateral Movement Process Injection: DLL Injection T1055.001 VirtualAllocEx + WriteProcessMemory into svchost.exe Collection Screen Capture T1113 GDI BitBlt screenshot Credential Access Credentials from Web Browsers T1555.003 Chrome/Edge/Brave/Opera/Vivaldi credential theft Credential Access Steal Web Session Cookie T1539 Cookie file theft from Chromium browsers Credential Access Credentials in Files T1552.001 OpenVPN auth.txt, crypto wallet files Command and Control Web Protocols T1071.001 HTTP C2 for payload delivery and exfiltration
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Shellcode used to inject into trusted processes such as sessionmsg.exe in order to load and stage SPECTRALVIPER in memory.
A loader identified by Triage in the same sample chain as ValleyRAT.
An open-source shellcode generator/loader used in this campaign to deliver CASTLESTEALER entirely in memory.
A position-independent in-memory loader/shellcode used to launch the final payload directly in memory, shifting execution away from managed .NET toward a more portable, runtime-independent payload delivery model.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.