Loading malware…
SmokeLoader is a long-running Windows malware family, active since at least 2011, that primarily serves as a modular loader and backdoor for follow-on payload delivery. It has been sold as a malware-as-a-service offering and is widely used in cybercrime operations to deploy additional malware, especially information stealers, proxy malware, cryptominers, and ransomware-enabling tooling. Reported associations include the criminal actor Smoky Spider, financially motivated intrusion activity linked to UAC-0006, delivery operations attributed to TA577, and ransomware ecosystems including 8Base and Phobos-related intrusions. Its infrastructure has also been linked to fast-flux command-and-control operations and was affected by Operation Endgame-related law-enforcement disruption.
SmokeLoader is commonly delivered through phishing and spearphishing campaigns, often via malicious documents or archive-based lures, and it may also be installed by other malware or bundled loaders. Once executed, it emphasizes stealth and anti-analysis. Samples are frequently packed, use high-entropy sections, runtime API resolution, code obfuscation, hidden or indirect control flow, anti-debugging, anti-virtualization, and environment checks. Some observed variants avoid infecting systems associated with Russia and Ukraine based on keyboard-language checks.
A core behavioral pattern is staged unpacking followed by process injection or process hollowing. SmokeLoader commonly creates a legitimate process in a suspended state, unmaps or replaces the target image, writes a payload into remote memory, adjusts thread context, and resumes execution. It has also been observed injecting into legitimate processes such as explorer.exe, including section-based injection workflows. The malware dynamically resolves APIs through hashing and export-table traversal rather than relying on a conventional import table, complicating static analysis.
Operationally, SmokeLoader functions as both an access mechanism and a payload delivery platform. Depending on the build and modules deployed, it can communicate with command-and-control infrastructure, download and execute additional malware, and maintain persistent footholds for follow-on activity. It has been observed delivering or coexisting with malware families including RedLine, Raccoon Stealer, Amadey, Glupteba, XMRig, SystemBC, and Phobos ransomware components. In ransomware intrusion chains, it has been used to obfuscate, unpack, and load later-stage payloads while helping attackers retain access and conceal activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The starting point of the latest attack chain discovered by FortiGuard Labs is a phishing email containing a Microsoft Excel attachment that, when launched, exploits years-old security flaws (e.g., CVE-2017-0199 and CVE-2017-11882) to drop a malware loader called Ande Loader, which is then used to deploy SmokeLoader on the compromised host. | Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks," Fortinet FortiGuard Labs said.
Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks," Fortinet FortiGuard Labs said. | The starting point of the latest attack chain discovered by FortiGuard Labs is a phishing email containing a Microsoft Excel attachment that, when launched, exploits years-old security flaws (e.g., CVE-2017-0199 and CVE-2017-11882) to drop a malware loader called Ande Loader, which is then used to deploy SmokeLoader on the compromised host.
The flaw, CVE-2025-0411 (CVSS score: 7.0), allows remote attackers to circumvent mark-of-the-web (MotW) protections and execute arbitrary code in the context of the current user. It was addressed by 7-Zip in November 2024 with version 24.09.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Related Stories ... Smokeloader Malware Targeting PrivatBank in Ukraine ... This attack involves the Smokeloader malware, deployed by a financially motivated threat group identified as UAC-0006.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : SmokeLoader (loader/backdoor modulaire)
По данным Intel 471, инфраструктура yalishanda была связана с группами Snatch Team (data extortion и ransomware), GandCrab, малварью Smokeloader...
SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware.
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020.
The SmokeLoader backdoor with a range of capabilities which depend on the modules included in any given build of the malware... 8base uses SystemBC to encrypt command and control traffic and Smokeloader, which provided initial obfuscation of the ransomware on ingress, unpacking, and loading of the Phobos ransomware.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): приобретение доменов (T1583.001)
В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): ... настройка DNS-серверов (T1583.002)
if its integrity is under 0x2000 it will execute a command using ShellExecuteExW to run malware again under the Windows Management Instrumentation Command-line ( WMIC )
it will execute a call to NtQueryInformationProcess()... using NtQuerySystemInformation() API... using NtAllocateVirtualMemory() API... using NtCreateSection() and NtMapViewOfSection() APIs
The main execution will revolve around a document that will spawn the SmokeLoader which will run, in most of its versions, a version of itself in a suspended state to inject code, after which it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions.
it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument
Once the process is created in a suspended state, it proceeds to introduce the binary inside the previously spawned process, which, through ProcessHollowing, will unmap data from itself, to write the binary inside, this is usually done through ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory.
result = (IAT_Struct->CreateProcessA_api)(ptr_memory, commandLine_); ... if ( result )
In some of the techniques used to hinder the analysis, such as code obfuscation, we find different hidden calls, as well as abuses of RET to reach calls that we will not see statically.
The samples that have been found have in most cases been detected as packed, due to the high level of entropy contained in their sections.
it tries to load libraries in RunTime... so it will obtain new functionalities during its execution... it fetches libraries during runtime and is dedicated to resolving APIs that it could use later on
thereby initiating its malicious operations while masquerading as a normal process
The main execution will revolve around a document that will spawn the SmokeLoader which will run, in most of its versions, a version of itself in a suspended state to inject code, after which it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions.
it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument
Once the process is created in a suspended state, it proceeds to introduce the binary inside the previously spawned process, which, through ProcessHollowing, will unmap data from itself, to write the binary inside, this is usually done through ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory.
result = (IAT_Struct->CreateProcessA_api)(ptr_memory, commandLine_); ... if ( result )
Smoke is decrypting the function that will be executed and after executing it re-encrypt it again... every function has its own decryption key.
checks anti-VM (VirtualBox, Wine, hyperviseur via NtQuerySystemInformation), checks anti-debugger
Smoke will go through all loaded modules in the victim machine... then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment... it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
The initial loader dropped dozens of executables into a user-writable staging folder and used hidden command activity to launch them.
using NtQuerySystemInformation() API and placing SystemProcessInformation as a class information type... then it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
checks anti-VM (VirtualBox, Wine, hyperviseur via NtQuerySystemInformation), checks anti-debugger
Smoke will go through all loaded modules in the victim machine... then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment... it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
VMRay Labs continued the research with “212.193.30[.]45”, which behaves not as a console but as a proxy/redirector that fronts the actor’s infrastructure behind the GitHub domain.
Web Protocols T1071.001 C2-трафик через HTTPS на стандартных портах (443)
MITRE ATT&CK ID ... T1090.003 Command and Control Multi-hop Proxy - flux-агенты как прокси
Dead-Drop Resolvers: http://t.me/borderxra ; http://t.me/jredmankun ;noc.social/@menaomi; qoto.org/@mniami ; pastebin.com/raw/A7dSG1te
The observed sample installed RedLine, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig, allowing the attackers to steal credentials, mine cryptocurrency, and retain access to infected systems.
175 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
166 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SmokeLoader is referenced as malware involved in earlier 7-Zip/Mark-of-the-Web bypass attack reporting; no further functional detail is provided in this content.
Referenced only in a related-stories section as malware used in a phishing campaign targeting PrivatBank in Ukraine.
A loader delivered in the STANDOFF infection chain, with dedicated delivery infrastructure listed in the report.
Modular loader/backdoor delivered as one of several payloads in the infection chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.