Loading malware…
Donut is an open-source position-independent shellcode generator and in-memory loader for Windows that enables execution of native PE files, .NET assemblies, and script-based payloads such as VBScript, JScript, and PowerShell without relying on conventional on-disk loading. It is widely used as a second-stage loader or shellcode wrapper in intrusion chains to reflectively map and execute payloads inside memory, often within trusted Windows processes. Donut is not inherently malicious, but it is frequently embedded in malware campaigns and post-exploitation frameworks because it supports fileless execution and flexible payload delivery.
Operationally, Donut-generated shellcode commonly decrypts and decompresses an embedded payload, reconstructs or manually maps the PE image in memory, resolves required APIs dynamically, and transfers execution to the payload entry point. Reported deployments show it being used to inject payloads into processes such as dllhost.exe, explorer.exe, RegAsm.exe, and other legitimate Windows binaries, including via APC injection, remote thread injection, callback-based execution, and reflective loading. It has been used to deliver a wide range of follow-on malware including remote access trojans, infostealers, banking trojans, and custom implants.
Donut is also associated with multiple defense-evasion features that make it attractive to threat actors. Observed variants and integrations have patched AMSI, WLDP, and ETW-related functions, used direct syscalls, syscall thunk tables, NTDLL unhooking, and manual in-memory PE reconstruction to reduce visibility to user-mode security tooling. In some campaigns, Donut shellcode has been further modified or wrapped by custom loaders that add anti-debugging, anti-VM checks, integrity validation, encryption, and staged decryption routines.
Across public reporting, Donut has appeared in phishing, ClickFix, malicious script, supply-chain, and loader-based intrusion chains, as well as in campaigns targeting cryptocurrency organizations, financial institutions, enterprises, and general Windows users. Its prevalence stems from its role as a reusable offensive utility for in-memory execution rather than as a standalone malware family with its own command-and-control logic or victim targeting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware stands out for its heavy use of advanced defense evasion methods, including NTDLL unhooking, direct syscalls via the Bouncy Gate technique, ETW patching, and reflective loading using the Donut shellcode.
The loader decrypts an AES-wrapped payload stored on disk. The decrypted payload contains a Donut shellcode loader that embeds the final RAT and uses Chaskey block cipher as part of its payload protection scheme. Donut then decrypts the final 32-bit native RAT, maps it, and executes it in memory.
While they still leverage classic droppers like PureCrypter and Rust-based loaders running Donut shellcode, they have added a potent new tool to their arsenal: PowerLoader.
Donut is an opensource position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files, and dotNET assemblies. In this attack, Donut is used to decrypt and execute the Atlantida stealer inside RegAsm.exe process memory.
This decrypted payload is Donut (aka DonutLoader, aka donut_injector) shellcode – an open-source, in-memory loader.
The decrypted shellcode is a Donut loader -- a framework for generating position-independent shellcode from PE files, .NET assemblies, and other executable formats.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
The payload uses Donut-generated shellcode and encrypted PowerShell scripts hidden behind image-like extensions to evade detection and conceal malicious content.
The VBScript initiates the PowerShell process and retrieves the next stage PowerShell script. The PowerShell script downloads the next stage payload from the attackers C2 server.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
Instead of calling high-level Windows APIs... the loader uses direct syscalls to perform sensitive memory operations.
Donut ... is a public position-independent code generator and in-memory loader... the Donut-derived code reconstructs the native PE, resolves imports, applies relocations... without requiring the final PE to be created as a normal file on disk.
The wrappers contain multiple in-memory execution implementations, including image mapping, module stomping... asynchronous procedure call (APC), NtCreateThreadEx
The dropped msbuild.exe contains an embedded PNG image used to conceal an obfuscated payload... The PNG image conceals a shellcode, which is obfuscated using a repeating 0xFF pattern.
The wrappers contain multiple in-memory execution implementations, including image mapping, module stomping... asynchronous procedure call (APC), NtCreateThreadEx
It then uses NtQueueApcThread to queue a user-mode Asynchronous Procedure Call (APC) containing the payload. Finally, it resumes the thread via NtResumeThread, transferring execution control to the next stage inside the DLLHost.exe process.
The malware patches this function by overwriting the first byte with the opcode 0xC3 (a RET instruction). This simple patch effectively disables ETW telemetry, preventing security tools from receiving critical events and creating a significant blind spot for defenders and incident responders.
The embedded third-stage payload is decrypted using the BCryptDecrypt API.
the user is immediately presented with a fake CAPTCHA verification instructions. The instructions trick the user into performing a specific sequence of clicks that ultimately spawn the MSHTA process and executes a malicious script.
The payload actively scans the infected machine for various indicators that could reveal the presence of a debugging tools, or sandboxed environment(Ex: machine configurations, graphics/display adapters etc).
It then actively searches for the following debugging tools/ Virtual machine processes by enumerating running processes and matching names/hashes.
74 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
87 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Donut-generated shellcode is used as an injected stage within the campaign to execute the final in-memory .NET implant inside a legitimate Windows process.
Offensive shellcode loader framework used inside the analyzed loaders to execute embedded payloads such as SafeRat or ValleyRat in memory.
Shellcode-based loader/wrapper used to execute payloads reflectively in memory and maintain a fileless execution chain.
Public in-memory loader framework used within the malware execution chain to reconstruct and execute embedded native payloads without writing the final PE as a normal file on disk.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.