Unpacking a laZzzy Donut

This report details analysis of a sophisticated multi-stage malware loader: obfuscated Python bytecode that decodes RC4-encrypted shellcode, a first Donut-generated shellcode layer, a laZzzy PE loader that uses AES-CBC plus XOR to encrypt an embedded shellcode, a second Donut layer producing a .NET DLL, and encrypted .NET resources executed in memory; the author describes static extraction techniques, tool modifications, and a custom lazzzy_dump extractor to recover and decrypt all stages.