Smoke Loader

Description

Smoke Loader is a malicious bot application used to load other malware, seen in the wild since at least 2011 with many different payloads over its lifetime. It is notorious for its use of deception and self protection techniques, and it ships with several plugins that extend its capabilities.

Stats

First seen: February 2022
Last seen: October 2026

Also known as

DofoilSmokeLoaderSmokeloader

MITRE ATT&CK techniques

14 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.005Visual Basic

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1055Process Injection
- T1055.012Process Hollowing
T1055Process Injection
- T1055.012Process Hollowing
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks

TA0006 Credential Access

T1552Unsecured Credentials
- T1552.001Credentials In Files
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1083File and Directory Discovery

TA0009 Collection

T1114Email Collection
- T1114.001Local Email Collection

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Downloader.SmokeLoader	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Smokeloader	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.SmokeLoader	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.SmokeLoader	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Smokeloader	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.SmokeLoader	ATP Sandbox Adv. Heuristics
Script-PowerShell.Backdoor.SmokeLoader	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Smokeloader	ATP Sandbox Adv. Heuristics
Script-WScript.Backdoor.SmokeLoader	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Smokeloader	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.SmokeLoader	ATP Sandbox Adv. Heuristics
Win32.Backdoor.SmokeLoader	ATP Sandbox Adv. Heuristics
Win32.Downloader.Dofoil	ATP Sandbox Adv. Heuristics
Win32.Trojan.Dofoil	ATP Sandbox Adv. Heuristics
Win32.Trojan.Smokeloader	ATP Sandbox Adv. Heuristics
Win32.Trojan.SmokeLoader	ATP Sandbox Adv. Heuristics
Win64.Trojan.Smokeloader	ATP Sandbox Adv. Heuristics
Win64.Trojan.SmokeLoader	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Smokeloader.C2 traffic detected	IPS-SWG
MALWARE-CNC Smokeloader.Generic suspicious traffic detected	IPS-SWG
MALWARE-CNC UNC4814.Smokeloader.c2 traffic detected	IPS-SWG
MALWARE-OTHER Win.Trojan.SmokeLoader variant download attempt	IPS-SWG