Loading malware…
SmokeLoader, also known as Dofoil and Smoke Loader, is a modular Windows malware loader sold in underground markets since approximately 2011. Its primary purpose is to download and execute additional malware, including information stealers, banking trojans, cryptominers, ransomware, and point-of-sale malware. Delivered payloads have included QakBot, RedLine Stealer, and Laplas. Optional modules extend its functionality to browser credential theft, confidential information collection, system and network reconnaissance, and backdoor access. It also supports persistence and command-and-control communications.
SmokeLoader conceals execution by injecting malicious code into legitimate Windows processes, including Windows Explorer and Internet Explorer. Its anti-analysis measures include debugger, sandbox, and virtualization detection, with registry-based checks for virtual-machine hardware identifiers. Variants use code obfuscation, encrypted strings and payloads, and encrypted command-and-control traffic. Its modular architecture allows operators to retrieve and execute additional plugins.
Distribution includes malicious documents delivered through spam and spearphishing. A campaign observed in September 2024 targeted Ukrainian government bodies and businesses using compromised email accounts, nested archives, homoglyph-disguised extensions, and executables masquerading as documents. The delivery chain exploited CVE-2025-0411 in 7-Zip to bypass Windows Mark-of-the-Web protections. SmokeLoader has been used by TA505 and Qilin ransomware affiliates across campaigns affecting multiple industries and countries. Its infrastructure was among the targets of Operation Endgame in May 2024.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The root cause of CVE-2025-0411 is that prior to version 24.09, 7-Zip did not properly propagate MoTW protections to the content of double-encapsulated archives. | This vulnerability was used to target both the Ukrainian government and other Ukrainian organizations in a SmokeLoader campaign that was likely deployed by Russian cybercrime groups.
Opportunistic threat actors have attempted to capitalize on the confusion surrounding these vulnerabilities by inserting malware into fake non-vendor patches.
Opportunistic threat actors have attempted to capitalize on the confusion surrounding these vulnerabilities by inserting malware into fake non-vendor patches.
Opportunistic threat actors have attempted to capitalize on the confusion surrounding these vulnerabilities by inserting malware into fake non-vendor patches.
This file is designed to take advantage of the second of the two vulnerabilities mention, CVE-2017-11882, a stack overflow vulnerability in the Microsoft Equation Editor that enables remote code execution on a vulnerable system. ... Conclusion While CVE-2017-0199 and CVE-2017-11882 were discovered in 2017, they are still being actively exploited in this and other malware campaigns. | In this blog, we will examine a recent instance of SmokeLoader, a malware variant that exploits both of these CVEs in its deployment chain. SmokeLoader (also known as Dofoil) has been available on the market in one form or another since 2011. Its primary purpose is to support the distribution of other malware families, such as Trickbot.
This stage uses the first of the two exploits involved in this attack, CVE-2017-0199. It also includes an embedded link that will attempt to download the file “receipt.doc” ... Conclusion While CVE-2017-0199 and CVE-2017-11882 were discovered in 2017, they are still being actively exploited in this and other malware campaigns. | In this blog, we will examine a recent instance of SmokeLoader, a malware variant that exploits both of these CVEs in its deployment chain. SmokeLoader (also known as Dofoil) has been available on the market in one form or another since 2011. Its primary purpose is to support the distribution of other malware families, such as Trickbot.
Spelevo Exploit Kitは2つの脆弱性(CVE-2018-8174とCVE-2018-15982)を悪用することが報告されていますが、PseudoGateによる攻撃ではCVE-2018-15982のみが観測されています。CVE-2018-15982はAdobe Flash PlayerのRCEの脆弱性です。
14 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recently sought someone to build an encryptor for their “Smoke Loader” malware.
The Smoke Loader banking trojan, used by TA505, checks registry key values in System\CurrentControlSet\Enum\IDE and System\CurrentControlSet\Enum\SCSI
"1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 256 publickeys: 183"
UAC-0006 is a financially motivated threat actor active since at least 2013. They primarily target Ukrainian organizations ... with phishing emails containing the SmokeLoader malware.
SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware.
Batloader has been observed to drop several malware payloads, such as Ursnif, Vidar, Bumbleloader, RedLine Stealer, ZLoader, Cobalt Strike, and SmokeLoader.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE Attack Techniques: Sr. No. Tactics Technique 2 Execution(TA0002) Shellcode Scheduled Task
MITRE Attack Techniques: Sr. No. Tactics Technique 2 Execution(TA0002) Shellcode Scheduled Task
MITRE Attack Techniques: Sr. No. Tactics Technique 2 Execution(TA0002) Shellcode Scheduled Task
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Multiple advance anti-debugging and analysis detection techniques. Anti-Sandbox, Anti-VM, and Anti-Hooking techniques. Code obfuscation techniques to thwart analysis. Decrypts code prior to execution and encrypts again after execution.
Once the victim downloads and opens the malicious document, the malware drops to the system and in the next stage injects malicious code into a compromised system process like explorer.exe and starts its malicious activity in disguise as a legitimate process.
MITRE Attack Techniques: Sr. No. Tactics Technique 6 Credential Access (TA0006) Credentials from Web Browsers & Files
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
Stealing confidential information. System and Network Reconnaissance.
Stealing confidential information. System and Network Reconnaissance.
MITRE Attack Techniques: Sr. No. Tactics Technique 7 Discovery(TA0007) Files and Directories Discovery
1,607 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercially supplied malware downloader used to install secondary payloads. The article dates criminal sales to approximately 2011 and describes its disruption during Operation Endgame in 2024.
A malware loader reportedly adopted by Qilin affiliates in 2024 and 2025.
Modular malware used to download and execute additional payloads.
SmokeLoader is referenced as malware involved in earlier 7-Zip/Mark-of-the-Web bypass attack reporting; no further functional detail is provided in this content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.