DonutLoader

DonutLoader is an in-memory shellcode loader and shellcode-generation framework used to wrap PE files, DLLs, .NET assemblies, and scripts into position-independent shellcode for memory-resident execution on Windows. It is commonly used as a staging component rather than a final payload, enabling operators to launch second-stage malware with minimal disk artifacts and reduced exposure to file-based detection. Reported use cases include delivery of backdoors, remote access trojans, infostealers, and credential theft malware such as SPECTRALVIPER, PureRAT, ValleyRAT, Beagle, AgentTesla, StealC v2, CASTLESTEALER, and other commodity or custom payloads.

Operationally, DonutLoader is associated with process injection and in-memory unpacking or execution of embedded payloads, often inside trusted Windows processes. It has appeared in intrusion chains involving DLL sideloading, LOLBin abuse, script-based droppers, PowerShell staging, and multi-stage loaders. Observed campaigns have used it after phishing, malvertising, fake software installers, fake AI or developer-tool download pages, WhatsApp-delivered scripts, and ClickFix-style social engineering. In several cases it was embedded in or launched by obfuscated loaders, malicious DLLs, JavaScript or batch droppers, or trojanized installers, then used to inject or execute the final malware entirely in memory.

DonutLoader has been observed across both espionage and financially motivated operations. It has been used in activity overlapping with APT32/OceanLotus tradecraft to stage a Windows backdoor, in Silver Fox- and ValleyRAT-linked activity, in campaigns delivering LummaStealer and AgentTesla, and in malvertising operations distributing CASTLESTEALER and Beagle. Because it is open source and broadly reusable, its presence alone is not sufficient for attribution. Its primary significance is as a flexible Windows loader that supports stealthy post-exploitation by enabling memory-only execution, process injection, and defense evasion in diverse intrusion chains.