Dofoil

Overview

Trojan:Win32/Dofoil (widely known in the threat intelligence community as Smoke Loader) is a highly versatile, modular, and historically prolific trojan downloader designed to stealthily infiltrate systems and act as an 'Initial Access Broker' for deploying secondary, high-severity payloads.

Understanding Dofoil (Smoke Loader)
To an end-user, a Dofoil infection is entirely invisible until the secondary payload (often ransomware, banking trojans like Trickbot, or infostealers) executes. For incident responders, Smoke Loader is a critical, complex threat. Active since at least 2011, it is sold on Russian-speaking underground forums. It is renowned for its advanced anti-analysis techniques, frequent updates, and its ability to seamlessly inject secondary payloads directly into the memory of legitimate processes, ensuring the final malware never touches the disk.

Execution and Evasion Strategies
Dofoil is primarily distributed via massive malspam campaigns (weaponized Office documents) or dropped by exploit kits (like RIG). Upon execution, the Smoke Loader stub employs heavy packing, API obfuscation, and anti-VM/anti-debugging checks. If it detects a sandbox, it terminates. If the environment is clear, it injects its core module into `explorer.exe` (Process Injection). It establishes persistence via the Registry Run keys or hidden scheduled tasks. Dofoil then communicates with its C2 infrastructure—often using a custom, encrypted protocol over HTTP—to download specialized 'plugins' (for credential theft) or to fetch the final, customer-purchased payload.

Indicators of Compromise (IoCs)
Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection targeting explorer.exe'. Network logs will often reveal Dofoil reaching out to compromised domains using HTTP POST requests containing encrypted, base64-encoded data. The presence of unexpected, hidden scheduled tasks is a strong IoC. Memory analysis is absolutely critical to extract the injected Smoke Loader modules and identify the secondary payloads running in memory.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DOFOIL {
    meta:
        description = "Detects Dofoil (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "dofoil" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Dofoil Activity
id: d7b1d8b514af0551969c2df0210a8b4c
status: experimental
description: Detects generic indicators of the dofoil malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*dofoil*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately; a Dofoil/Smoke Loader infection almost guarantees the presence of severe secondary payloads like ransomware.
2. Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident payloads.
3. Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Dofoil persistence mechanisms.
4. Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not close an incident simply because the initial Dofoil dropper was quarantined; the payload often executes purely in memory.
2. Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries.

References & External Analysis

• Search "dofoil" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Copperturtle
• Cycbot
• Murka
• Fayu
• Prosti

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/dofoil.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.