{
  "family": "smokeloader",
  "sample_count": 21,
  "category": "loader",
  "description": "<h3>Executive Summary</h3>\nSmokeLoader (also known as Dofoil) is a highly prolific, modular Trojan downloader that has been active in the cybercriminal underground since at least 2011. It operates primarily as an Initial Access Broker (IAB) tool, designed to silently compromise a host, establish stealthy persistence, and \"load\" (download and execute) secondary, highly profitable malware payloads, such as enterprise ransomware, banking trojans (like TrickBot), or cryptocurrency miners. It is renowned for its aggressive anti-analysis and defense evasion techniques.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSmokeLoader is predominantly distributed through vast, automated spam campaigns (malspam) containing malicious ZIP attachments, macro-enabled Office documents, or via exploit kits hosted on compromised websites.\n\nUpon execution, it exhibits advanced evasion and payload delivery:\n<ul>\n<li><strong>PROPagate Injection:</strong> SmokeLoader is famous for utilizing the PROPagate (process hollowing/injection) technique, injecting its malicious code into legitimate, built-in Windows processes (like `explorer.exe`) to completely hide its execution from task managers and legacy AV.</li>\n<li><strong>Aggressive Anti-Analysis:</strong> The loader actively checks for signs it is running in a sandbox or virtual machine (VMware, VirtualBox). If a sandbox is detected, it terminates itself immediately. It also actively attempts to disable Windows Defender and other EDR sensors.</li>\n<li><strong>Plugin Architecture:</strong> Beyond its core downloader function, SmokeLoader can receive plugins from its Command and Control (C2) server. These plugins add specific capabilities, such as credential theft from browsers or executing distributed denial-of-service (DDoS) attacks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA SmokeLoader detection is a critical, \"Code Red\" incident. Because it is a modular loader, the initial infection is rarely the endgame. If SmokeLoader successfully executes, it is almost certain that a devastating secondary payload (like Ryuk or Conti ransomware) is imminent.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be severed from the network instantly to prevent SmokeLoader from reaching its C2 server to download the secondary ransomware payload.</li>\n<li><strong>Memory Forensics:</strong> Because SmokeLoader injects deeply into `explorer.exe`, standard file scanning is insufficient. Incident responders must utilize memory forensics (e.g., Volatility) to identify and extract the injected payload from active RAM.</li>\n<li><strong>Total Re-imaging:</strong> Due to its deep system hooking and rootkit-like persistence, cleaning the machine is unreliable. A complete bare-metal wipe and re-image from a known-good baseline is required.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.SmokeLoader",
    "Downloader.Dofoil",
    "Win32/SmokeLoader"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is SmokeLoader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A loader whose main job is downloading and installing other malware; it is also known as Dofoil."
      }
    },
    {
      "@type": "Question",
      "name": "How does SmokeLoader avoid detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It employs anti-analysis and evasion techniques to hinder researchers and security tools."
      }
    },
    {
      "@type": "Question",
      "name": "What does SmokeLoader deliver?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A wide range of other malware families, depending on the operator using it."
      }
    },
    {
      "@type": "Question",
      "name": "How is SmokeLoader distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing, exploit kits, and bundling with other malware."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's Smoke Loader entry (S0226), linked on this page."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.002",
    "T1562.001",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:47:42Z",
  "sources": [
    {
      "name": "MITRE ATT&CK: Smoke Loader (S0226)",
      "url": "https://attack.mitre.org/software/S0226"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0226",
  "type": "Backdoor / Downloader",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}