Loading malware…
SmokeLoader, also known as Dofoil, is a Windows malware family primarily used as a modular loader for delivering additional payloads. It has been active for many years in cybercrime operations and is commonly associated with pay-per-install activity, malware distribution services, and multistage intrusion chains. SmokeLoader has been used to deploy a wide range of follow-on malware, including banking trojans, stealers, and other commodity criminal tooling, and has appeared in campaigns linked to malvertising, exploit-kit delivery, malicious documents, and script-based download chains.
Technically, SmokeLoader is known for obfuscation and encrypted communications. Recent variants have used RC4-based string encryption and RC4-encrypted payload delivery from command-and-control infrastructure, with support for downloading multiple plugin modules. It has also been observed deobfuscating its code at runtime and using process hollowing to spawn a legitimate Windows process and replace its in-memory code with malicious content.
SmokeLoader supports credential theft, particularly from browser-stored data. It has been observed searching for credentials saved by web browsers and parsing Firefox credential storage files to recover login information. In addition to payload delivery and credential access, it establishes persistence through multiple Windows mechanisms, including Registry Run keys, Startup-folder scripts, and scheduled tasks.
Distribution has been observed through malvertising ecosystems that redirect victims through exploit infrastructure, as well as through Visual Basic Script and PowerShell-based staging chains. It has also been used as an intermediate loader in broader malware operations, including campaigns delivering other banking malware. SmokeLoader has been referenced in operations involving other criminal malware families and has been used by multiple threat actors as a reusable malware delivery component rather than a single-actor-exclusive tool.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Some mails were sent by another Ukrainian IP ‘91.192.45[.]182’, used in a previous SmokeLoader campaign from September 2024 where UAC-0006 took advantage of a 7-Zip zero-day vulnerability (CVE-2025-0411) to bypass Windows Mark-of-the-Web protections by double archiving files. | UAC-0006 is a financially motivated threat actor active since at least 2013. They primarily target Ukrainian organizations ... with phishing emails containing the SmokeLoader malware.
This file is designed to take advantage of the second of the two vulnerabilities mention, CVE-2017-11882, a stack overflow vulnerability in the Microsoft Equation Editor that enables remote code execution on a vulnerable system. ... Conclusion While CVE-2017-0199 and CVE-2017-11882 were discovered in 2017, they are still being actively exploited in this and other malware campaigns. | In this blog, we will examine a recent instance of SmokeLoader, a malware variant that exploits both of these CVEs in its deployment chain. SmokeLoader (also known as Dofoil) has been available on the market in one form or another since 2011. Its primary purpose is to support the distribution of other malware families, such as Trickbot.
This stage uses the first of the two exploits involved in this attack, CVE-2017-0199. It also includes an embedded link that will attempt to download the file “receipt.doc” ... Conclusion While CVE-2017-0199 and CVE-2017-11882 were discovered in 2017, they are still being actively exploited in this and other malware campaigns. | In this blog, we will examine a recent instance of SmokeLoader, a malware variant that exploits both of these CVEs in its deployment chain. SmokeLoader (also known as Dofoil) has been available on the market in one form or another since 2011. Its primary purpose is to support the distribution of other malware families, such as Trickbot.
Spelevo Exploit Kitは2つの脆弱性(CVE-2018-8174とCVE-2018-15982)を悪用することが報告されていますが、PseudoGateによる攻撃ではCVE-2018-15982のみが観測されています。CVE-2018-15982はAdobe Flash PlayerのRCEの脆弱性です。
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 256 publickeys: 183"
UAC-0006 is a financially motivated threat actor active since at least 2013. They primarily target Ukrainian organizations ... with phishing emails containing the SmokeLoader malware.
SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware.
Smokeloader is a popular bot and a veteran in its field – being sold on underground cybercriminal markets since 2011, this piece of malware is used mainly for loading other malicious software, usually obtained from a third party.
Batloader has been observed to drop several malware payloads, such as Ursnif, Vidar, Bumbleloader, RedLine Stealer, ZLoader, Cobalt Strike, and SmokeLoader.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : SmokeLoader (loader/backdoor modulaire)
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Malvertising campaigns leading to exploit kits are nowhere near as common these days... relying on drive-by downloads.
The chain of events led from the email to --> link to a Word document --> enable Word document macro --> Smoke Loader --> Trickbot.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
We can now observe a decoded command that downloads a string from americanocoffea[.]ru . The resulting string is then executed using Invoke-Expression (IEX).
We can see that WScript.exe has ultimately spawned 3 new processes. Cmd.exe, Conhost.exe and powershell.exe. In the cmd.exe command - You can see that cmd.exe was used to spawn Powershell via the /c argument.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
we observed Office documents, which exploit vulnerabilities in MS Office products, and malicious loaders like Smoke Loader or GuLoader distributing FormBook and XLoader Windows samples
Now that the capture is ready, it's time to run the original malware script. This is as simple as double clicking on the original .vbs file. Windows will run the script using wscript.exe by default.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The script is "only" 10 lines long and primarily consists of a large blob of decimal values (line 1), a large blob of text (line 3). The remainder of the surrounding code is used to decode the decimal and text blob.
The report’s Tactics, Techniques and Procedures section lists T1027.002 Obfuscated Files or Information: Software Packing.
Once launched, they would both download a SmokeLoader payload from the following URL, posing as a legitimate PuTTY executable.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
Raccoon Stealer C2s 34.105.147[.]92/gate/log.php chinadevmonster[.]top/gate/log.php ... Smoke Loader C2s dkajsdjiqwdwnfj[.]info
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
1,588 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modular malware used to download and execute additional payloads.
SmokeLoader is referenced as malware involved in earlier 7-Zip/Mark-of-the-Web bypass attack reporting; no further functional detail is provided in this content.
Referenced only in a related-stories section as malware used in a phishing campaign targeting PrivatBank in Ukraine.
A loader delivered in the STANDOFF infection chain, with dedicated delivery infrastructure listed in the report.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.