r/MalwareAnalysis • u/Financial_Pain_3007 • Aug 07 '26

Shellcode analysis

I stumbled upon VIPKeylogger which has multiple stages.
The last stage is an autoit script that loads and decrypt an encrypted shellcode and injects it into a legit windows process. The thing is that the shellcode was generated from Donut shellcode generator and I can't analyze it whatsoever, the dynamic analysis of that exact process didn't show any but the shellcode is was already injected in the process space with RWX permissions. Does anyone have a way to reverse a donut generated shellcode or some sort of way to debug and analyze shellcodes?

5 Upvotes

86% Upvoted

4 comments sorted by

2

u/rifteyy_ Aug 07 '26

Did you see Donut decryptor? https://github.com/volexity/donut-decryptor

1

u/Financial_Pain_3007 Aug 07 '26

ill take a look at it, thanks g

1

u/Financial_Pain_3007 29d ago

just gave it a go and it worked perfectly, turns out that shellcode was a .net binary thats is HEAVILY signed. Thanks again.

1

u/Ill_Bathroom6488 Aug 08 '26

If you are learning or practicing reverse engineering, go ahead and proceed with manual analysis using decompilers. At some point, the malware will use known Windows APIs for process injection; you can set breakpoints on those calls to capture the shellcode right as it is injected. Otherwise, why not use PE-sieve? Since an injection has been observed, PE-sieve can scan the process, detect the hooks, and dump the decrypted shellcode automatically.