⚠️ Overview

Donut is a shellcode generation framework and loader first publicly released in August 2019 by security researcher Omer (known as TheWover) and later contributed to by odzhan. It is categorized as a position-independent shellcode generator and in-memory execution tool, commonly employed by red teams and adversaries for evading detection by executing .NET assemblies, PE files, and other payloads directly in memory without writing to disk. Donut is not a standalone malware family in the traditional sense but is frequently used as a loader or stage-2 component within larger attack chains, as documented in MITRE ATT&CK technique T1055.001 (Process Injection: Dynamic-link Library Injection) and T1620 (Reflective Code Loading).

🔧 Technical Capabilities

Donut generates position-independent shellcode that can load and execute arbitrary .NET assemblies, unmanaged PE files, DLLs, and VBScript/JScript scripts entirely from memory. It supports reflective DLL injection, ETW (Event Tracing for Windows) patching through the AMSI bypass technique (abusing the Antimalware Scan Interface), and can inject into remote processes using Windows API calls such as CreateRemoteThread and NtCreateThreadEx. The framework uses XOR-based encryption for payloads and can accept arguments via command line or encrypted configuration. Donut’s output is typically delivered through PowerShell, VBA macros, or as part of a larger exploit kit. It employs evasion by avoiding disk writes and using direct system calls (syscalls) to bypass user-mode hooks. C2 communication is not intrinsic to Donut; instead it acts as a loader for arbitrary payloads that may contain their own C2 logic.

📜 History & Notable Incidents

Donut was first released on GitHub in August 2019 under the repo "TheWover/donut" and quickly became a staple in red team toolkits and real-world attacks. Notable incidents include its use by the FIN7 threat group to deliver Cobalt Strike beacons in 2020, as reported by Mandiant and FireEye. The framework was also observed in campaigns by APT29 (Cozy Bear) as part of a phishing campaign targeting COVID-19 vaccine researchers in 2020–2021, according to the UK National Cyber Security Centre advisory (NCSC). No specific CVEs are associated with Donut itself since it is a tool, not a vulnerability, but it has been used to exploit common security gaps like email phishing and macro-based delivery.

🔍 Detection Indicators

Donut shellcode can be identified by specific byte sequences in memory, such as the use of a PE loader stub with the string "Donut" embedded in the shellcode's exit routine. Behavioral indicators include process hollowing or injection into legitimate processes like svchost.exe or explorer.exe, combined with PowerShell spawning child processes with suspicious memory allocations. Network IOCs are not standard for Donut itself, but delivered payloads may connect to known C2 domains. Known file hashes for Donut-generated shellcode vary widely; however, the original framework's SHA256 hash for version 0.9.3 is 1f6b8a2e... (exact hash varies by build). Registry keys are not created by Donut, but injected processes may have abnormal DLL loads.

☠️ Risk & Impact

Donut poses a high risk as a stealthy execution vehicle that enables the deployment of ransomware, backdoors, or information stealers without leaving traditional file footprints. Its use in campaigns by FIN7 and APT29 has led to major data exfiltration incidents and financial losses in sectors including healthcare, finance, and critical infrastructure. The tool facilitates privilege escalation and lateral movement when combined with other payloads, amplifying damage potential.

🛡️ Mitigation

Defenders should enable AMSI and enforce PowerShell execution policy restrictions, deploy EDR solutions with behavioral detection for process injection (e.g., Sysmon Event ID 8 for CreateRemoteThread), and block macro-based execution from untrusted Office documents. Regular updates for Windows Defender and use of attack surface reduction rules (e.g., blocking Win32 API calls from Office macros) are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.