Loading story…
Researchers detailed how SmokeLoader continues to operate as a heavily obfuscated, multi-stage malware loader that hides its execution flow and decrypts later payloads in memory before contacting command-and-control infrastructure. Reverse-engineering of recent samples showed opaque predicate obfuscation, encrypted functions, API hashing based on djb2 with an added XOR layer, and a compressed third stage that is decrypted with XOR keys before being unpacked with LZSA2. Analysts also reported that the final decrypted stage can have a damaged PE header while retaining usable sections, complicating static analysis but still allowing recovery of configuration data such as RC4-encrypted strings and multiple C2 URLs.
Separate analysis traced a Visual Basic Script infection chain that used wscript.exe to launch an obfuscated PowerShell downloader, which then fetched an executable from americanocoffea[.]ru into the victim's temp directory and executed it as a SmokeLoader payload. One investigated sample was observed delivering the Vidar infostealer, reinforcing SmokeLoader’s role as a malware distribution platform rather than a single-purpose implant. Public research from CERT Polska and independent analysts collectively highlights SmokeLoader’s layered packing, staged delivery, and reusable infrastructure as key factors that make the malware effective for initial access and follow-on payload deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Embee Research published a walkthrough showing how an obfuscated VBS sample launched PowerShell stages that downloaded qScTdMN.exe from americanocoffea[.]ru, which the analyst attributed to SmokeLoader. The post identified the malicious domain, payload URL, and executable as useful indicators of compromise.
The domain americanocoffea[.]ru had 11 detections out of 87 on VirusTotal at the time cited in the analysis. This was used as supporting evidence that the infrastructure involved in the delivery chain was malicious.
OALABS Research published a reverse-engineering walkthrough of a SmokeLoader sample that was observed downloading Vidar. The post detailed SmokeLoader's staged architecture, deobfuscation, stage-3 unpacking, and extracted configuration and C2 data.
A malware analysis post titled "Deep Analysis of SmokeLoader" was published by n1ghtw0lf. The reference indicates the publication date explicitly.
CERT Polska released an analysis of the SmokeLoader malware family, documenting its behavior and technical characteristics. The reference provides no explicit publication date in the supplied content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
embee-research.ghost.io
Open sourceresearch.openanalysis.net
Open sourcen1ght-w0lf.github.io
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**SmokeLoader** has continued to evolve as an actively maintained malware loader and backdoor, with newer variants replacing older XOR-based string and command-and-control decoding with **RC4-based encryption** and more complex controller-domain decryption. Reporting indicates infected systems send host details to C2 infrastructure and receive encrypted payloads that can deliver plugins, download additional files, or manage related malware such as **Dofoil**. Researchers also observed host-derived mutex generation, a trait that can be used defensively to block some infections, alongside debug-related code that suggests ongoing development. Separate technical analysis describes SmokeLoader as a phishing-delivered malware family associated with **Smoky Spider**, using runtime API resolution, anti-debugging and anti-VM checks, **process hollowing**, and injection into `explorer.exe` to sustain command-and-control communications or deploy follow-on payloads. The malware’s role as a loader for additional malicious tools, combined with updated obfuscation and encryption routines, underscores its continued use in multi-stage intrusions and its adaptability against analysis and disruption efforts.
Aug 15, 2026
Researchers traced multiple **SmokeLoader** operations to live command-and-control infrastructure that supported credential theft, screenshot capture, clipboard theft, host profiling, and data exfiltration. One March 2026 campaign used a **ClickFix** social-engineering lure, an MSI installer, and a Go-based loader to deploy the **Remus** plugin, with exfiltration sent to `baxe[.]pics:48261`; investigators extracted configuration data including the C2 URL, campaign ID, plugin markers, and a **ChaCha20** key that allowed captured traffic to be decrypted. Cross-sample analysis linked the same builder output to SmokeLoader deliveries via **Amadey**, **Phorpiex**, and the ClickFix/GOLoader chain, pointing to a shared malware-as-a-service or affiliate ecosystem. Separate analysis tied SmokeLoader to a broader dual-family operation involving **Fuery**, likely run by an operator using the alias **"ingermany"**, who used a Flask-based panel disguised as **"InsureFlow Pro"** and a second **"Monkey"** panel for Fuery management. Investigators documented repeated OPSEC failures across the infrastructure, including reused certificates, exposed registration data, same-day domain registrations, and a C2 domain that shared a VPS with a legitimate Arabic-language learning platform, `qimmaedu[.]com`, while malware traffic beaconed to `coox[.]live` and `baxe[.]pics`. The reports also highlighted unusual technical overlaps, including Go 1.20.1 builds, Raft protocol type-name obfuscation, split C2 services on high ports, and hosting links to providers and subnets previously associated with **Phorpiex**, reinforcing the assessment that financially motivated operators were reusing infrastructure across malware families and legitimate services.
Jun 29, 2026
Researchers reported multiple financially motivated malware campaigns using **SmokeLoader** as a delivery mechanism for follow-on payloads including **Gozi ISFB**, **ZLoader**, **Oski**, **AveMaria**, **Cobalt Strike**, **SystemBC**, **RecordBreaker**, and the **Laplas Clipper** cryptocurrency hijacker. In one campaign set, attackers abused website contact forms and sent phishing lures posing as copyright complaints, directing victims to malicious documents hosted on legitimate services such as **Google Drive**. Talos found the initial payloads were wrapped in a shared crypter identified by the DOS-stub string **"Salfram,"** indicating a common tooling layer across otherwise varied malware deliveries. The activity relied on evasive and modular infection chains designed to complicate detection and maximize monetization. The **Salfram** crypter used obfuscation methods including fake API calls, fragmented control flow, self-modifying code, and memory allocation through `ZwAllocateVirtualMemory`, while later-stage malware added persistence and theft capabilities. Cyble said **Laplas Clipper** monitored the clipboard for cryptocurrency wallet addresses, pulled regex patterns and replacement addresses from `clipper[.]guru`, and persisted by copying itself into `%appdata%` and creating a scheduled task that ran every minute. The combined use of phishing, legitimate hosting platforms, crypter-based obfuscation, and multi-payload delivery shows an adaptable criminal ecosystem built to steal credentials, proxy access, banking data, and cryptocurrency funds.
Aug 15, 2026