Donoff | Netskope Threat Labs

Description

Donoff is a malicious downloader distributed through malicious Office documents that delivers additional malware onto infected systems. The documents rely on malicious macros, and users who enable them trigger a chain that downloads follow on payloads from remote servers. The family has circulated for years as a generic first stage in campaigns that deliver bankers, stealers, and ransomware.

Stats

First seen: January 2022
Last seen: October 2026

Alert name variants

Alert Name	Engine
Archive-JAR.Dropper.Donoff	ATP Sandbox Adv. Heuristics
ByteCode-JAVA.Downloader.Donoff	ATP Sandbox Adv. Heuristics
ByteCode-SWF.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Document-Excel.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-Excel.Dropper.Donoff	ATP Sandbox Adv. Heuristics
Document-Excel.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Document-HTML.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Document-Office.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-Office.Dropper.Donoff	ATP Sandbox Adv. Heuristics
Document-Office.Exploit.Donoff	ATP Sandbox Adv. Heuristics
Document-Office.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Document-PDF.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-PowerPoint.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-RTF.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-RTF.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Document-Word.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Document-Word.Dropper.Donoff	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Email-MIME.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Email-MIME.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Linux.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Linux.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Script-BAT.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Script-Macro.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Script-Macro.Dropper.Donoff	ATP Sandbox Adv. Heuristics
Script-Macro.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Script-PowerShell.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Script-WScript.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Donoff	ATP Sandbox Adv. Heuristics
Script.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Shortcut.Downloader.Donoff	ATP Sandbox Adv. Heuristics
W97M.Donoff.A	AV
W97M.Downloader.Donoff.J	AV
W97M.Downloader.Donoff.J:EA52C	ATP Sandbox Adv. Heuristics
Win32.Downloader.Donoff	ATP Sandbox Adv. Heuristics
Win32.Trojan.Donoff	ATP Sandbox Adv. Heuristics

Related families

Acsogenixx Boxter Bulz Cheetah Convagent

References

malpedia.caad.fkie.fraunhofer.de