{
  "family": "dofoil",
  "sample_count": 90,
  "category": "ransomware",
  "description": "Trojan:Win32/Dofoil (widely known in the threat intelligence community as Smoke Loader) is a highly versatile, modular, and historically prolific trojan downloader designed to stealthily infiltrate systems and act as an 'Initial Access Broker' for deploying secondary, high-severity payloads.<br><br><b>Understanding Dofoil (Smoke Loader)</b><br>To an end-user, a Dofoil infection is entirely invisible until the secondary payload (often ransomware, banking trojans like Trickbot, or infostealers) executes. For incident responders, Smoke Loader is a critical, complex threat. Active since at least 2011, it is sold on Russian-speaking underground forums. It is renowned for its advanced anti-analysis techniques, frequent updates, and its ability to seamlessly inject secondary payloads directly into the memory of legitimate processes, ensuring the final malware never touches the disk.<br><br><b>Execution and Evasion Strategies</b><br>Dofoil is primarily distributed via massive malspam campaigns (weaponized Office documents) or dropped by exploit kits (like RIG). Upon execution, the Smoke Loader stub employs heavy packing, API obfuscation, and anti-VM/anti-debugging checks. If it detects a sandbox, it terminates. If the environment is clear, it injects its core module into `explorer.exe` (Process Injection). It establishes persistence via the Registry Run keys or hidden scheduled tasks. Dofoil then communicates with its C2 infrastructure—often using a custom, encrypted protocol over HTTP—to download specialized 'plugins' (for credential theft) or to fetch the final, customer-purchased payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection targeting explorer.exe'. Network logs will often reveal Dofoil reaching out to compromised domains using HTTP POST requests containing encrypted, base64-encoded data. The presence of unexpected, hidden scheduled tasks is a strong IoC. Memory analysis is absolutely critical to extract the injected Smoke Loader modules and identify the secondary payloads running in memory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1497.001",
    "T1547.001",
    "T1055.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; a Dofoil/Smoke Loader infection almost guarantees the presence of severe secondary payloads like ransomware.",
    "Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident payloads.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Dofoil persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Dofoil dropper was quarantined; the payload often executes purely in memory.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}