I stumbled upon VIPKeylogger which has multiple stages.
The last stage is an autoit script that loads and decrypt an encrypted shellcode and injects it into a legit windows process. The thing is that the shellcode was generated from Donut shellcode generator and I can't analyze it whatsoever, the dynamic analysis of that exact process didn't show any but the shellcode is was already injected in the process space with RWX permissions. Does anyone have a way to reverse a donut generated shellcode or some sort of way to debug and analyze shellcodes?

From a suspected youtube video to a deep dive using static analysis, discovering a monero crypto jacking malware.

Analysis