Loading malware…
DonutLoader is a Windows-focused shellcode loader built around the open-source Donut framework for converting PE files, DLLs, and .NET assemblies into position-independent shellcode for in-memory execution. In intrusion chains it is commonly used as an intermediate staging component rather than the final payload, enabling operators to launch secondary malware with minimal disk artifacts and reduced forensic visibility.
Observed DonutLoader activity includes unpacking or decrypting embedded payloads, allocating executable memory, manually reconstructing payloads in memory, creating execution threads, and injecting shellcode into legitimate Windows processes. Reported process targets include trusted system and user processes, and some campaigns use DonutLoader as part of DLL sideloading or LOLBin-assisted execution chains. It has also been observed wrapped inside obfuscated scripts, malicious DLLs, batch files, JavaScript droppers, trojanized installers, and supply-chain-delivered binaries.
DonutLoader has been used to deliver a wide range of follow-on malware, including SPECTRALVIPER, Beagle, CASTLESTEALER, AgentTesla, Remcos, PureRAT, ValleyRAT, AdaptixC2-associated payloads, and bespoke stealers. In several campaigns it was paired with defense-evasion measures such as AMSI and ETW tampering, anti-sandbox checks, custom syscall stubs, process injection, and fileless execution. Delivery vectors associated with DonutLoader-enabled chains include phishing and spearphishing attachments, ClickFix fake-CAPTCHA lures, malvertising and fake software installers, SEO-poisoned landing pages, and trojanized software or package ecosystems.
The loader appears across both criminal and espionage operations. It has been observed in campaigns linked to Vietnamese state-aligned activity overlapping with APT32/Canvas Cyclone/OceanLotus, in malvertising operations delivering commodity stealers, in fake AI software lures deploying the Beagle backdoor, and in campaigns associated with Silver Fox-linked ValleyRAT activity. Its role is best understood as a flexible in-memory execution mechanism that threat actors embed into broader delivery chains to stage payloads stealthily on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The unsigned DLL (dbg.config) contained DONUTLOADER shellcode which it attempted to inject into sessionmsg.exe. DONUTLOADER was configured to load the SPECTRALVIPER backdoor, and ultimately the situationally-dependent P8LOADER or POWERSEAL malware families.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
...Velvet Tempest ... used a ClickFix lure ... to drop payloads like DonutLoader and CastleRAT.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence is established via a scheduled task that silently launches the malware at user logon.
First, social engineering was employed, followed by a PowerShell dropper, and finally an in-memory infostealer payload was delivered.
Next, a PowerShell script is retrieved from this URL via the Invoke-RestMethod command and executed directly within the current process.
Scheduled-task persistence via a VBS launcher: The malware creates a scheduled task that executes a Visual Basic Script (VBS), ensuring it automatically runs again after a system reboot or user logon.
The package is copied, marked as executable and launched in a new thread... the loader uses raw syscalls supplied by a small framework... Since all high-risk operations ... run through these handcrafted syscalls, standard API calls to monitor are never seen by common user-land EDR hooks.
If the first payload is extracted from the sample, we find a shellcode, followed by a SafeRAT binary. The shellcode used to load the binary is DONUT.
This CAPTCHA instructs the user to execute a series of keyboard shortcuts (Win + R, Ctrl + V, Enter), which runs a PowerShell command previously copied to the clipboard by the website. | First, social engineering was employed... The initial point of entry is user-driven execution of a PowerShell command, delivered through a social engineering tactic known as ClickFix.
Persistence is established via a scheduled task that silently launches the malware at user logon.
The cryptographic loop identified at the end of the installation in persistence is a simple implementation of RC4 ... installs itself in persistence ... A “Run” registry key installing a Windows Security persistence can indicate an infection by the loader.
Persistence is established via a scheduled task that silently launches the malware at user logon.
The unsigned DLL (dbg.config) contained DONUTLOADER shellcode which it attempted to inject into sessionmsg.exe... SPECTRALVIPER can load and inject executable files... command handlers include InjectShellcodeInProcess, CreateProcessAndInjectShellcode, InjectPEInProcess, and CreateProcessAndHollow.
Python runtime abuse for Early Bird APC injection into suspended legitimate processes
The cryptographic loop identified at the end of the installation in persistence is a simple implementation of RC4 ... installs itself in persistence ... A “Run” registry key installing a Windows Security persistence can indicate an infection by the loader.
Eight bytes near the start of the string serve double duty as an RC4 key. The loader decodes the text, applies RC4 with the extracted key, and then passes the result through an LZMA stream.
DonutLoader is a shellcode-based loader leveraging the “Donut” fileless execution framework to deploy secondary payloads such as PureLogs stealer in-memory, avoiding disk-based artifacts
The adversary renamed the SysInternals ProcDump utility, used for collecting memory metadata from running processes, to masquerade as the Windows debugger utility (windbg.exe).
The unsigned DLL (dbg.config) contained DONUTLOADER shellcode which it attempted to inject into sessionmsg.exe... SPECTRALVIPER can load and inject executable files... command handlers include InjectShellcodeInProcess, CreateProcessAndInjectShellcode, InjectPEInProcess, and CreateProcessAndHollow.
Python runtime abuse for Early Bird APC injection into suspended legitimate processes
AMSI and ETW tampering to reduce security visibility: The malware disables or bypasses AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) to reduce the likelihood of detection by security tools.
loads a resource, decrypts it, and executes it in memory ... The cryptographic loop ... is a simple implementation of RC4.
Using the renamed ProcDump application with the -md flag, the adversary loaded dbg.config, an unsigned DLL containing malicious code... One example leveraged the Internet Explorer program (ExtExport.exe) to load a DLL, while another technique involved side-loading a malicious DLL (dnsapi.dll) using a legitimate application (nslookup.exe).
First, the code checks the machine’s UI language and exits immediately if it detects a CIS locale, such as Russian (ru), Belarusian (by), or Kazakh (kz).
First, the code checks the machine’s UI language and exits immediately if it detects a CIS locale...
It performs environment checks to evade analysis systems before creating a hidden staging directory at C:\ProgramData\IntelDriver.
The PowerShell Stager injects a compact .NET loader ... directly into its own powershell.exe process. The primary objective of this loader ist to decrypt a Donut shell-code package, map it in place, and start it without dropping a file or spawning another process.
IcedID post-infection C2 traffic: 94.140.114[.]40 port 443 - primsenetwolk[.]com - HTTPS traffic 94.140.114[.]40 port 443 - onyxinnov[.]lol - HTTPS traffic 158.255.211[.]126 port 443 - trashast[.]wiki - HTTPS traffic
97 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-stage Windows loader delivered via an obfuscated batch script. It performs anti-analysis checks, reconstructs embedded payloads, uses a renamed PowerShell binary for execution, establishes persistence with a scheduled task, injects Donut shellcode into explorer.exe, tampers with AMSI and ETW, and runs an obfuscated memory-resident .NET implant that communicates with Telegram and remote C2 infrastructure.
A secondary payload loader used as a delivery mechanism for follow-on malware.
Shellcode-based loader using the Donut fileless execution framework to deploy secondary payloads in memory and avoid disk artifacts. Recent campaigns used ClickFix-style spoofed licensing sites and malicious PowerShell commands.
An intermediate shellcode loader used in the third variant to execute the Beagle backdoor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.