Loading malware…
SmokeLoader, also known as SmokeLdr, is a long-running modular Windows malware family first observed in 2011. It primarily functions as a loader and downloader for additional payloads, while supporting information theft, reconnaissance, persistence, command-and-control, and backdoor-oriented functions through modular components. It has been used to deploy ransomware, banking trojans, cryptominers, point-of-sale malware, and credential stealers.
SmokeLoader has been distributed through malicious Office and PDF documents delivered in spam and targeted spearphishing campaigns, as well as through malvertising and exploit-kit activity. It commonly conceals execution by injecting or hollowing legitimate Windows processes. Known persistence mechanisms include scheduled tasks, Registry autorun mechanisms, and Startup-folder scripts.
The malware can collect credentials stored by web browsers, including Firefox login data, and conduct host and network reconnaissance. It incorporates anti-debugging, anti-sandbox, anti-virtual-machine, anti-hooking, code-obfuscation, runtime decryption, and encrypted payload and network-traffic handling. Variants have used RC4-encrypted command-and-control responses and modular plugins. SmokeLoader has historically been associated with Russian-speaking cybercriminal actors, and it has also been adopted by ransomware affiliates, including Qilin-associated operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Opportunistic threat actors have attempted to capitalize on the confusion surrounding these vulnerabilities by inserting malware into fake non-vendor patches.
Opportunistic threat actors have attempted to capitalize on the confusion surrounding these vulnerabilities by inserting malware into fake non-vendor patches.
Opportunistic threat actors have attempted to capitalize on the confusion surrounding these vulnerabilities by inserting malware into fake non-vendor patches.
Some mails were sent by another Ukrainian IP ‘91.192.45[.]182’, used in a previous SmokeLoader campaign from September 2024 where UAC-0006 took advantage of a 7-Zip zero-day vulnerability (CVE-2025-0411) to bypass Windows Mark-of-the-Web protections by double archiving files. | UAC-0006 is a financially motivated threat actor active since at least 2013. They primarily target Ukrainian organizations ... with phishing emails containing the SmokeLoader malware.
This file is designed to take advantage of the second of the two vulnerabilities mention, CVE-2017-11882, a stack overflow vulnerability in the Microsoft Equation Editor that enables remote code execution on a vulnerable system. ... Conclusion While CVE-2017-0199 and CVE-2017-11882 were discovered in 2017, they are still being actively exploited in this and other malware campaigns. | In this blog, we will examine a recent instance of SmokeLoader, a malware variant that exploits both of these CVEs in its deployment chain. SmokeLoader (also known as Dofoil) has been available on the market in one form or another since 2011. Its primary purpose is to support the distribution of other malware families, such as Trickbot.
This stage uses the first of the two exploits involved in this attack, CVE-2017-0199. It also includes an embedded link that will attempt to download the file “receipt.doc” ... Conclusion While CVE-2017-0199 and CVE-2017-11882 were discovered in 2017, they are still being actively exploited in this and other malware campaigns. | In this blog, we will examine a recent instance of SmokeLoader, a malware variant that exploits both of these CVEs in its deployment chain. SmokeLoader (also known as Dofoil) has been available on the market in one form or another since 2011. Its primary purpose is to support the distribution of other malware families, such as Trickbot.
Spelevo Exploit Kitは2つの脆弱性(CVE-2018-8174とCVE-2018-15982)を悪用することが報告されていますが、PseudoGateによる攻撃ではCVE-2018-15982のみが観測されています。CVE-2018-15982はAdobe Flash PlayerのRCEの脆弱性です。
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 256 publickeys: 183"
UAC-0006 is a financially motivated threat actor active since at least 2013. They primarily target Ukrainian organizations ... with phishing emails containing the SmokeLoader malware.
SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware.
Smokeloader is a popular bot and a veteran in its field – being sold on underground cybercriminal markets since 2011, this piece of malware is used mainly for loading other malicious software, usually obtained from a third party.
Batloader has been observed to drop several malware payloads, such as Ursnif, Vidar, Bumbleloader, RedLine Stealer, ZLoader, Cobalt Strike, and SmokeLoader.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : SmokeLoader (loader/backdoor modulaire)
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Malvertising campaigns leading to exploit kits are nowhere near as common these days... relying on drive-by downloads.
The chain of events led from the email to --> link to a Word document --> enable Word document macro --> Smoke Loader --> Trickbot.
MITRE Attack Techniques: Sr. No. Tactics Technique 2 Execution(TA0002) Shellcode Scheduled Task
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
We can now observe a decoded command that downloads a string from americanocoffea[.]ru . The resulting string is then executed using Invoke-Expression (IEX).
We can see that WScript.exe has ultimately spawned 3 new processes. Cmd.exe, Conhost.exe and powershell.exe. In the cmd.exe command - You can see that cmd.exe was used to spawn Powershell via the /c argument.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
we observed Office documents, which exploit vulnerabilities in MS Office products, and malicious loaders like Smoke Loader or GuLoader distributing FormBook and XLoader Windows samples
Now that the capture is ready, it's time to run the original malware script. This is as simple as double clicking on the original .vbs file. Windows will run the script using wscript.exe by default.
MITRE Attack Techniques: Sr. No. Tactics Technique 2 Execution(TA0002) Shellcode Scheduled Task
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
MITRE Attack Techniques: Sr. No. Tactics Technique 2 Execution(TA0002) Shellcode Scheduled Task
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Once the victim downloads and opens the malicious document, the malware drops to the system and in the next stage injects malicious code into a compromised system process like explorer.exe and starts its malicious activity in disguise as a legitimate process.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Multiple advance anti-debugging and analysis detection techniques. Anti-Sandbox, Anti-VM, and Anti-Hooking techniques. Code obfuscation techniques to thwart analysis. Decrypts code prior to execution and encrypts again after execution.
The report’s Tactics, Techniques and Procedures section lists T1027.002 Obfuscated Files or Information: Software Packing.
Once launched, they would both download a SmokeLoader payload from the following URL, posing as a legitimate PuTTY executable.
Once the victim downloads and opens the malicious document, the malware drops to the system and in the next stage injects malicious code into a compromised system process like explorer.exe and starts its malicious activity in disguise as a legitimate process.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
MITRE Attack Techniques: Sr. No. Tactics Technique 6 Credential Access (TA0006) Credentials from Web Browsers & Files
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
Stealing confidential information. System and Network Reconnaissance.
Stealing confidential information. System and Network Reconnaissance.
MITRE Attack Techniques: Sr. No. Tactics Technique 7 Discovery(TA0007) Files and Directories Discovery
1,597 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware loader reportedly adopted by Qilin affiliates in 2024 and 2025.
Modular malware used to download and execute additional payloads.
SmokeLoader is referenced as malware involved in earlier 7-Zip/Mark-of-the-Web bypass attack reporting; no further functional detail is provided in this content.
Referenced only in a related-stories section as malware used in a phishing campaign targeting PrivatBank in Ukraine.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.