SmokeLoader, also known as Dofoil, is a modular bot used primarily to download other malware onto a compromised system. It has been in operation since at least 2011 and has been used in various campaigns worldwide. The malware is sold in underground forums and is frequently updated with new capabilities, evasion techniques, and bug fixes.
MITRE ATT&CK Tactics Relevant to SmokeLoader:
- Initial Access (T1190): SmokeLoader is often delivered via exploit kits or malspam campaigns. It uses various methods to gain initial access, including spear-phishing and drive-by compromise.
- Execution (T1059): SmokeLoader executes a malicious payload on the compromised system. It uses a variety of techniques to achieve this, including process injection and scheduled tasks.
- Persistence (T1060): SmokeLoader uses registry modifications for persistence. It adds or modifies registry keys to ensure it is executed each time the system is booted.
- Defense Evasion (T1070): SmokeLoader employs various techniques to avoid detection by security software. These include obfuscation of its code, process hollowing, and disabling of security services.
- Command and Control (T1043): SmokeLoader communicates with a remote server to receive commands and send data. It uses HTTP for its command and control protocol.
- Exfiltration (T1041): SmokeLoader can exfiltrate data from the compromised system to the command and control server.
Details of Binaries:
SmokeLoader is typically delivered as a PE32 executable. The binary is often packed and obfuscated to avoid detection. It uses process hollowing to inject its payload into a new process, often a legitimate Windows process. This makes it harder for security software to detect its malicious activities.
Additional Information:
SmokeLoader has a modular architecture, allowing it to download and execute additional modules as needed. This makes it a versatile tool for cybercriminals, as it can be used to carry out a wide range of malicious activities. The malware is also known to use a domain generation algorithm (DGA) for its command and control infrastructure, making it harder for defenders to block its communication channels.