Loading malware…
SmokeLoader is a long-running Windows malware family active since at least 2011 that functions primarily as a modular loader and backdoor for follow-on payload delivery. It has been widely used in cybercrime operations and sold under a malware-as-a-service model, and has been associated with the criminal actor commonly tracked as Smoky Spider. SmokeLoader is frequently used to deploy additional malware including information stealers, proxy malware, loaders, and ransomware-enabling tooling, and has appeared in intrusion chains involving groups such as TA577 and ransomware operations including 8Base. Its infrastructure has also been affected by Operation Endgame, and reporting has linked some of its command-and-control operations to fast-flux techniques and abuse-resistant hosting ecosystems.
On infected systems, SmokeLoader emphasizes stealth, anti-analysis, and staged execution. Samples are commonly packed or otherwise obfuscated, often showing high-entropy sections, sparse imports, runtime API resolution, and on-demand code decryption. Observed anti-analysis behavior includes anti-debugging, anti-virtualization, security-product checks, and environment filtering such as keyboard-language checks intended to avoid infecting systems associated with Russia and Ukraine. SmokeLoader commonly resolves APIs dynamically through hashing or runtime export parsing, hindering static analysis.
Execution frequently relies on process injection and process hollowing. Observed behavior includes creating a legitimate process in a suspended state, unmapping its original image, allocating memory in the target process, writing an in-memory payload, adjusting thread context, and resuming execution. Injection into legitimate Windows processes, including explorer.exe, is a recurring technique used to conceal malicious activity and launch subsequent stages. Some variants use section-based injection and remote thread creation to execute decompressed or decrypted payloads.
SmokeLoader is commonly delivered through phishing and spearphishing campaigns, including malicious document attachments, and it is also distributed by other malware loaders and bundled crimeware delivery chains. Once established, it can contact command-and-control infrastructure, download and execute additional payloads, and provide backdoor functionality whose exact feature set depends on the modules included in a given build. It has been observed as part of broad commodity-malware ecosystems that support credential theft, ransomware staging, and other financially motivated intrusions across a wide range of sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The starting point of the latest attack chain discovered by FortiGuard Labs is a phishing email containing a Microsoft Excel attachment that, when launched, exploits years-old security flaws (e.g., CVE-2017-0199 and CVE-2017-11882) to drop a malware loader called Ande Loader, which is then used to deploy SmokeLoader on the compromised host. | Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks," Fortinet FortiGuard Labs said.
Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks," Fortinet FortiGuard Labs said. | The starting point of the latest attack chain discovered by FortiGuard Labs is a phishing email containing a Microsoft Excel attachment that, when launched, exploits years-old security flaws (e.g., CVE-2017-0199 and CVE-2017-11882) to drop a malware loader called Ande Loader, which is then used to deploy SmokeLoader on the compromised host.
The flaw, CVE-2025-0411 (CVSS score: 7.0), allows remote attackers to circumvent mark-of-the-web (MotW) protections and execute arbitrary code in the context of the current user. It was addressed by 7-Zip in November 2024 with version 24.09.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : SmokeLoader (loader/backdoor modulaire)
По данным Intel 471, инфраструктура yalishanda была связана с группами Snatch Team (data extortion и ransomware), GandCrab, малварью Smokeloader...
SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware.
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020.
The SmokeLoader backdoor with a range of capabilities which depend on the modules included in any given build of the malware... 8base uses SystemBC to encrypt command and control traffic and Smokeloader, which provided initial obfuscation of the ransomware on ingress, unpacking, and loading of the Phobos ransomware.
Originally specializing in the Panda banking malware in Italy, it has since branched out to Poland, Germany, Spain, and Japan, using a variety of other malware including Chthonic, Smoke Loader, Nymaim, ZLoader, and finally URLZone in combination with Ursnif, both banking Trojans.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): приобретение доменов (T1583.001)
В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): ... настройка DNS-серверов (T1583.002)
if its integrity is under 0x2000 it will execute a command using ShellExecuteExW to run malware again under the Windows Management Instrumentation Command-line ( WMIC )
The main execution will revolve around a document that will spawn the SmokeLoader which will run, in most of its versions, a version of itself in a suspended state to inject code, after which it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions.
it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument
Once the process is created in a suspended state, it proceeds to introduce the binary inside the previously spawned process, which, through ProcessHollowing, will unmap data from itself, to write the binary inside, this is usually done through ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory.
result = (IAT_Struct->CreateProcessA_api)(ptr_memory, commandLine_); ... if ( result )
In some of the techniques used to hinder the analysis, such as code obfuscation, we find different hidden calls, as well as abuses of RET to reach calls that we will not see statically.
The samples that have been found have in most cases been detected as packed, due to the high level of entropy contained in their sections.
it tries to load libraries in RunTime... so it will obtain new functionalities during its execution... it fetches libraries during runtime and is dedicated to resolving APIs that it could use later on
inside sub_630 , the shellcode uses stack string for evade detection by Security Solutions
thereby initiating its malicious operations while masquerading as a normal process
The main execution will revolve around a document that will spawn the SmokeLoader which will run, in most of its versions, a version of itself in a suspended state to inject code, after which it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions.
it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument
Once the process is created in a suspended state, it proceeds to introduce the binary inside the previously spawned process, which, through ProcessHollowing, will unmap data from itself, to write the binary inside, this is usually done through ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory.
result = (IAT_Struct->CreateProcessA_api)(ptr_memory, commandLine_); ... if ( result )
Smoke is decrypting the function that will be executed and after executing it re-encrypt it again... every function has its own decryption key.
checks anti-VM (VirtualBox, Wine, hyperviseur via NtQuerySystemInformation), checks anti-debugger
Smoke will go through all loaded modules in the victim machine... then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment... it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
using NtQuerySystemInformation() API and placing SystemProcessInformation as a class information type... then it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
checks anti-VM (VirtualBox, Wine, hyperviseur via NtQuerySystemInformation), checks anti-debugger
Smoke will go through all loaded modules in the victim machine... then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment... it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments
VMRay Labs continued the research with “212.193.30[.]45”, which behaves not as a console but as a proxy/redirector that fronts the actor’s infrastructure behind the GitHub domain.
Web Protocols T1071.001 C2-трафик через HTTPS на стандартных портах (443)
MITRE ATT&CK ID ... T1090.003 Command and Control Multi-hop Proxy - flux-агенты как прокси
Dead-Drop Resolvers: http://t.me/borderxra ; http://t.me/jredmankun ;noc.social/@menaomi; qoto.org/@mniami ; pastebin.com/raw/A7dSG1te
it will execute an explorer.exe that it will inject again in order to perform the malicious C&C actions or download other files using legitimate software.
Fast flux - не самостоятельная атака, а инфраструктурная техника на этапе Command and Control. В терминах MITRE ATT&CK покрывает несколько тактик: ... T1568.001 ... Fast Flux DNS - ротация IP
143 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
163 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modular loader/backdoor delivered as one of several payloads in the infection chain.
Loader malware included among the delivered commodity payloads tied to the campaign.
Malware explicitly cited as operating via or being linked to the Media Land bulletproof hosting infrastructure.
SmokeLoader6
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.