DonutTool
Donut is an open source framework used to generate position-independent shellcode. Donut generated code has been used by multiple threat actors to inject and load malicious payloads into memory.From MITRE ATT&CK
Last reported 27 days ago, by AhnLab ASEC10 reports
ATT&CK techniques
6 of 53 · each with the sentence it comes from- T1055Process Injection
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1036Masquerading
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1053.005Scheduled Task
“…YESSSSSSSS.' If both conditions are met, the script copies itself to the %PUBLIC%\Libraries folder and establishes persistence via a Scheduled Task.”
- T1684Social Engineering
“ClickFix is a social engineering technique that tricks end-users into pasting and running a malicious command.”
- T1056.001Keylogging
“T1056.001”
- T1027Obfuscated Files or Information
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk“The shellcode loading methods have also continued to evolve, including the use of sRDI, Donut Loader, the addition of XOR operations, a shift from CreateFile to VirtualAlloc-based loading, and the application of code virtualization.”
-
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint“Donut is described as "a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies".”
-
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader“The function scans for byte sequences and string signatures characteristic of Donut shellcode, then obfuscates them with a mask composed of 144, 204, and randomly generated uppercase characters to evade detection.”
-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“For defense evasion, the payload uses multiple techniques, including disabling AMSI and EtwEvent, as well as the use of Donut, an open-source tool used to stealthily execute .NET assemblies.”
-
Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response“When unpacked, these new.bin files were identified to be shellcode files created using Donut, an open-source framework used to generate position-independent shellcode.”
-
LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan“The result is Donut shellcode that is injected into the running pmp.exe process (NosyStealer Stage 1) using the CreateRemoteThread API in the SERV.dll case, and into a newly created notepad.exe process using the SetThreadContext API in the msi.dll case.”
-
ClickFix Gets Creative: Malware Buried in Images“Figure 26: DiE identifying Donut shellcode”
-
Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C“Code obfuscation leveraged Donut tooling, and malicious browser extensions began monitoring user activity in both Brave and Chrome browsers.”
-
Detonating Beacons to Illuminate Detection Gaps“AMSI’s expansion to CLR-based scripts (C#), prompted the development of tools like Donut, converting .NET assemblies into shellcode to bypass AMSI checks.”
-
Analyzing Initial Access Across Today's Business Environment“Figure 1: Donut chart showing the distribution of initial access vectors”
Thanks — we review every report.