Loading malware…
SmokeLoader, also known as Dofoil and SmokeLdr, is a long-running Windows malware family active since at least 2011 that primarily serves as a loader and backdoor for follow-on payloads. It has been used in criminal operations to deliver additional malware, especially information stealers, and has been associated with the threat actor commonly tracked as Smoky Spider. It also appears in broader crimeware delivery ecosystems involving groups such as TA577 and ransomware operations including 8Base, where it has been used to stage or load later malware components.
SmokeLoader is characterized by heavy packing, runtime API resolution, code obfuscation, and anti-analysis protections. Reported samples use dynamic import reconstruction, API hashing, hidden or indirect control flow, on-demand code decryption, anti-debugging checks, anti-virtualization logic, and process or module enumeration to frustrate reverse engineering and automated analysis. Some variants also perform locale or keyboard-language checks to avoid infecting systems associated with parts of the CIS region.
A common execution pattern involves creating a legitimate process in a suspended state, unmapping its original image, writing a malicious payload into the remote process, adjusting thread context, and resuming execution. This process hollowing workflow has been observed both in unpacking shellcode and in later-stage execution. SmokeLoader has also been observed injecting into legitimate Windows processes such as explorer.exe, including section-based injection techniques, to conceal execution and support command-and-control activity or delivery of additional malware.
Operationally, SmokeLoader is most notable for enabling downstream compromise rather than acting as the final payload itself. Depending on the build and included modules, it can function as a backdoor with modular capabilities while downloading, unpacking, and launching secondary malware. It has been observed in phishing-driven intrusion chains and in malware distribution ecosystems where other loaders or potentially unwanted software can also install it. Its role in the cybercrime supply chain has made it a recurring target of international disruption efforts under Operation Endgame.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The starting point of the latest attack chain discovered by FortiGuard Labs is a phishing email containing a Microsoft Excel attachment that, when launched, exploits years-old security flaws (e.g., CVE-2017-0199 and CVE-2017-11882) to drop a malware loader called Ande Loader, which is then used to deploy SmokeLoader on the compromised host. | Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks," Fortinet FortiGuard Labs said.
Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks," Fortinet FortiGuard Labs said. | The starting point of the latest attack chain discovered by FortiGuard Labs is a phishing email containing a Microsoft Excel attachment that, when launched, exploits years-old security flaws (e.g., CVE-2017-0199 and CVE-2017-11882) to drop a malware loader called Ande Loader, which is then used to deploy SmokeLoader on the compromised host.
The flaw, CVE-2025-0411 (CVSS score: 7.0), allows remote attackers to circumvent mark-of-the-web (MotW) protections and execute arbitrary code in the context of the current user. It was addressed by 7-Zip in November 2024 with version 24.09.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware.
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020.
The SmokeLoader backdoor with a range of capabilities which depend on the modules included in any given build of the malware... 8base uses SystemBC to encrypt command and control traffic and Smokeloader, which provided initial obfuscation of the ransomware on ingress, unpacking, and loading of the Phobos ransomware.
Originally specializing in the Panda banking malware in Italy, it has since branched out to Poland, Germany, Spain, and Japan, using a variety of other malware including Chthonic, Smoke Loader, Nymaim, ZLoader, and finally URLZone in combination with Ursnif, both banking Trojans.
SMOKEY SPIDER is a cybercrime group that develops Smoke Loader (also known as Smoke Bot), a malicious bot that is used to upload other malware. Smoke Loader has been available since at least 2011, and operates as a malware distribution service for a number of different payloads, including—but not limited to—DanaBot, TrickBot, and Qakbot.
We identified and mapped a live SmokeLoader and Fuery botnet operation run by a single operator ("ingermany") using a custom Flask-based C2 panel disguised as an insurance SaaS application.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
if its integrity is under 0x2000 it will execute a command using ShellExecuteExW to run malware again under the Windows Management Instrumentation Command-line ( WMIC )
The main execution will revolve around a document that will spawn the SmokeLoader which will run, in most of its versions, a version of itself in a suspended state to inject code, after which it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions.
it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument
Once the process is created in a suspended state, it proceeds to introduce the binary inside the previously spawned process, which, through ProcessHollowing, will unmap data from itself, to write the binary inside, this is usually done through ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory.
result = (IAT_Struct->CreateProcessA_api)(ptr_memory, commandLine_); ... if ( result )
In some of the techniques used to hinder the analysis, such as code obfuscation, we find different hidden calls, as well as abuses of RET to reach calls that we will not see statically.
The samples that have been found have in most cases been detected as packed, due to the high level of entropy contained in their sections.
it tries to load libraries in RunTime... so it will obtain new functionalities during its execution... it fetches libraries during runtime and is dedicated to resolving APIs that it could use later on
inside sub_630 , the shellcode uses stack string for evade detection by Security Solutions
thereby initiating its malicious operations while masquerading as a normal process
The main execution will revolve around a document that will spawn the SmokeLoader which will run, in most of its versions, a version of itself in a suspended state to inject code, after which it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions.
it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument
Once the process is created in a suspended state, it proceeds to introduce the binary inside the previously spawned process, which, through ProcessHollowing, will unmap data from itself, to write the binary inside, this is usually done through ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory.
result = (IAT_Struct->CreateProcessA_api)(ptr_memory, commandLine_); ... if ( result )
Smoke is decrypting the function that will be executed and after executing it re-encrypt it again... every function has its own decryption key.
it subsequently performs various Anti-Vm and Anti-dbg techniques
Smoke will go through all loaded modules in the victim machine... then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment... it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
Retrieves a handle to Shell’s desktop window, in our case it’s Explorer.exe
then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SCSI Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE
it will check the location of the current machine via keyboard language
using NtQuerySystemInformation() API and placing SystemProcessInformation as a class information type... then it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
after that, smoke reads the PEB structure to obtain access to the element placed at 0xA4 which points to OSMajorVersion... it first will check the Architecture of the victim machine to determine the appropriate payload
it subsequently performs various Anti-Vm and Anti-dbg techniques
Smoke will go through all loaded modules in the victim machine... then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment... it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
Smoke Loader employs consistent efforts to obfuscate its Command and Control ( C2 ) operations by simulating communication requests that resemble legitimate traffic patterns to well-known websites, including microsoft.com, bing.com, adobe.com
134 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
159 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SmokeLoader6
SmokeLoader7
A malware family in the dropper/loader ecosystem referenced as a prior law-enforcement target.
SmokeLoader is listed as a malware family delivered in StealC-linked activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.