Loading malware…
DonutLoader is a Windows in-memory shellcode loader built around the Donut fileless execution framework and widely used as an intermediate stage for deploying secondary payloads without leaving conventional disk artifacts. It wraps .NET assemblies, DLLs, or executables into position-independent shellcode and is commonly used to inject or launch payloads inside legitimate Windows processes, including through reflective PE loading and process injection. Observed tradecraft includes loading managed implants into trusted processes, staging payloads entirely in memory, and reducing the effectiveness of file-based scanning and triage.
Across observed campaigns, DonutLoader has been used to deliver a broad range of follow-on malware including Agent Tesla, Remcos, PureRAT, CASTLESTEALER, Beagle, SPECTRALVIPER, AdaptixC2, ValleyRAT-associated payloads, and other stealers and RATs. It has appeared in intrusion chains involving phishing attachments, heavily obfuscated batch or script loaders, malvertising, fake software installers, fake AI-themed download sites, ClickFix social-engineering lures, and DLL sideloading. In several cases it was embedded in malicious DLLs or script-driven loaders that reconstructed or decrypted shellcode at runtime before injecting it into processes such as explorer.exe or sessionmsg.exe.
The loader is closely associated with defense-evasion-focused execution. Documented behaviors include fileless payload staging, reflective loading, process injection, and use alongside AMSI and ETW patching performed by surrounding loaders or payload chains. Some campaigns used DonutLoader as part of multi-stage loaders that performed anti-analysis checks, locale exclusions, sandbox and virtual-machine detection, or custom syscall-based execution before transferring control to the final implant. DonutLoader itself is best characterized as a delivery mechanism rather than a standalone access or theft payload, but it plays a central role in post-exploitation chains by enabling stealthy in-memory execution of secondary malware on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The unsigned DLL (dbg.config) contained DONUTLOADER shellcode which it attempted to inject into sessionmsg.exe. DONUTLOADER was configured to load the SPECTRALVIPER backdoor, and ultimately the situationally-dependent P8LOADER or POWERSEAL malware families.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
...Velvet Tempest ... used a ClickFix lure ... to drop payloads like DonutLoader and CastleRAT.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Using the recovered values, the malware establishes persistence by registering a scheduled task named IntelDriver through the Windows schtasks utility, causing execution upon user logon.
First, social engineering was employed, followed by a PowerShell dropper, and finally an in-memory infostealer payload was delivered.
The reconstructed content is subsequently Base64-decoded and decrypted using a repeating XOR key (tk) before being executed through PowerShell's Invoke-Expression (IEX) mechanism.
The infection chain begins with a heavily obfuscated Windows batch script that conceals its functionality through variable substitution and control-flow obfuscation.
Scheduled-task persistence via a VBS launcher: The malware creates a scheduled task that executes a Visual Basic Script (VBS), ensuring it automatically runs again after a system reboot or user logon.
The package is copied, marked as executable and launched in a new thread... the loader uses raw syscalls supplied by a small framework... Since all high-risk operations ... run through these handcrafted syscalls, standard API calls to monitor are never seen by common user-land EDR hooks.
It then uses DonutLoader shellcode to load the final .NET payload into memory, reducing evidence for scanners looking only for suspicious files.
This CAPTCHA instructs the user to execute a series of keyboard shortcuts (Win + R, Ctrl + V, Enter), which runs a PowerShell command previously copied to the clipboard by the website. | First, social engineering was employed... The initial point of entry is user-driven execution of a PowerShell command, delivered through a social engineering tactic known as ClickFix.
Using the recovered values, the malware establishes persistence by registering a scheduled task named IntelDriver through the Windows schtasks utility, causing execution upon user logon.
The loader first attempts deployment into the primary target process (explorer.exe)... opens the target process using OpenProcess(), allocates executable memory... writes the recovered Donut shellcode using WriteProcessMemory(), and initiates execution through CreateRemoteThread().
Analysis revealed multiple layers of obfuscation, including environment-variable substitution, dynamic command reconstruction, extensive control-flow flattening, and large volumes of junk REM, ECHO, and SET statements intended to hinder static analysis.
Following execution notification, the malware prepares a disguised execution vehicle by creating a renamed copy of powershell.exe as HDVz.exe within the user's Downloads directory.
The loader first attempts deployment into the primary target process (explorer.exe)... opens the target process using OpenProcess(), allocates executable memory... writes the recovered Donut shellcode using WriteProcessMemory(), and initiates execution through CreateRemoteThread().
AMSI and ETW tampering to reduce security visibility: The malware disables or bypasses AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) to reduce the likelihood of detection by security tools.
The reconstructed content is subsequently Base64-decoded and decrypted using a repeating XOR key (tk) before being executed through PowerShell's Invoke-Expression (IEX) mechanism.
Using the renamed ProcDump application with the -md flag, the adversary loaded dbg.config, an unsigned DLL containing malicious code... One example leveraged the Internet Explorer program (ExtExport.exe) to load a DLL, while another technique involved side-loading a malicious DLL (dnsapi.dll) using a legitimate application (nslookup.exe).
First, the code checks the machine’s UI language and exits immediately if it detects a CIS locale, such as Russian (ru), Belarusian (by), or Kazakh (kz).
The script terminates execution when specific username and filesystem conditions are met... Systems reporting less than 3 GB of RAM are considered suspicious, causing the script to exit without further execution.
To evade detection and reduce security visibility, the malware employs process injection, dynamic Application Programming Interface (API) resolution, Antimalware Scan Interface (AMSI) bypass, Event Tracing for Windows (ETW) tampering, and memory-resident execution techniques.
the malware invokes PowerShell to query the Win32_ComputerSystem class and retrieve the total amount of installed physical memory.
IcedID post-infection C2 traffic: 94.140.114[.]40 port 443 - primsenetwolk[.]com - HTTPS traffic 94.140.114[.]40 port 443 - onyxinnov[.]lol - HTTPS traffic 158.255.211[.]126 port 443 - trashast[.]wiki - HTTPS traffic
Process Monitor captured a curl.exe process issuing an HTTP POST request to the Telegram Bot API /sendMessage endpoint.
After process injection, the .NET implant attempts to connect to 167.88.167.9:8356 via outbound TCP, suggesting a dedicated command-and-control channel.
101 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used in the infection chain to load the final .NET Agent Tesla payload directly into memory, helping evade file-based detection.
A loader used in the infection chain to execute the final .NET payload in memory, helping reduce on-disk artifacts and evade file-based detection.
Loader/shellcode component used in the infection chain to perform reflective PE injection so the final Agent Tesla payload does not touch the filesystem.
A multi-stage Windows loader delivered via an obfuscated batch script. It performs anti-analysis checks, reconstructs embedded payloads, uses a renamed PowerShell binary for execution, establishes persistence with a scheduled task, injects Donut shellcode into explorer.exe, tampers with AMSI and ETW, and runs an obfuscated memory-resident .NET implant that communicates with Telegram and remote C2 infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.