A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode
Essential information
- Published
- 14/08/2025 14:10
- Modified
- 14/08/2025 15:32
- Tags
- 2025-08-14 donut dynamic analysis ida pro malware analysis reverse engineering shellcode static analysis x64dbg
- Related entities
- 1 observables, 3 techniques (mitre), 1 malware
Description
This tutorial provides an in-depth analysis of a malware infection chain using shellcode generated by the Donut tool. It covers various stages of the attack, including initial download, trace concealment, and final payload delivery. The tutorial aims to familiarize readers with common analysis tools like dnSpy, IDA Pro, x64dbg, and ProcessHacker, while demonstrating both static and dynamic analysis techniques. It highlights malware behaviors such as dynamic API resolution, process injection, and AMSI bypassing. The excerpt focuses on analyzing an unknown function in the shellcode, explaining PC-relative addressing and position-independent code techniques used by malware to access resources.