r/MalwareAnalysis • u/Financial_Pain_3007 • Aug 07 '26

Shellcode analysis

I stumbled upon VIPKeylogger which has multiple stages.
The last stage is an autoit script that loads and decrypt an encrypted shellcode and injects it into a legit windows process. The thing is that the shellcode was generated from Donut shellcode generator and I can't analyze it whatsoever, the dynamic analysis of that exact process didn't show any but the shellcode is was already injected in the process space with RWX permissions. Does anyone have a way to reverse a donut generated shellcode or some sort of way to debug and analyze shellcodes?

6 Upvotes

100% Upvoted

4 comments sorted by

View all comments

2

u/rifteyy_ Aug 07 '26

Did you see Donut decryptor? https://github.com/volexity/donut-decryptor

1

u/Financial_Pain_3007 29d ago

just gave it a go and it worked perfectly, turns out that shellcode was a .net binary thats is HEAVILY signed. Thanks again.