SmokeLoader (aliases: Smoke Bot, Dofoil, Sharik) is a criminal loader/backdoor that has been sold and operated on underground forums since 2011 by the developer tracked by CrowdStrike as SMOKY SPIDER, a financially motivated actor believed to operate out of the Russian Federation / Eastern Europe. The malware's core value proposition to its operator and its criminal customers is delivery-as-a-service: SmokeLoader itself has limited built-in capability, and instead focuses on reliably landing on a host, evading analysis, and pulling down whichever second-stage modules (information stealers, ransomware, banking trojans, or additional loaders) the operator or a paying third party wants executed.

The infection chain documented in the primary source begins with a dropper delivered via phishing attachments, drive-by downloads, exploit kits, or bundled with cracked/pirated software (a common PPI "pay-per-install" monetization channel for this actor). On execution, the initial-stage binary spawns a second copy of itself in a suspended state using CreateProcessInternalA/W with the CREATE_SUSPENDED flag, then performs textbook process hollowing against the suspended process image: it calls ZwUnmapViewOfSection to remove the original (legitimate) image from the process's address space, VirtualAlloc/VirtualAllocEx to reserve fresh memory in the target, ZwWriteVirtualMemory/WriteProcessMemory to write the malicious PE image into that space, and ResumeThread to resume execution of the now-hollowed process. In observed builds, explorer.exe is the preferred hollowing target, letting the malicious code execute under a trusted, always-running system process to blend into normal endpoint telemetry.

Before and during this injection sequence, SmokeLoader runs a battery of anti-analysis checks: anti-VM/sandbox detection (T1497.001-class system fingerprinting to identify virtualized analysis environments), anti-debugger checks to detect attached debuggers, and code obfuscation techniques including hidden/indirect call constructions and abuse of the RET instruction to break static disassembly and control-flow-graph reconstruction. Packed sections with abnormally high entropy further frustrate static signature detection. API resolution is deferred at runtime via LoadLibrary + GetProcAddress rather than static import-table linking, denying analysts an easy API-call inventory from the PE header alone.

Once injected and running inside explorer.exe, SmokeLoader establishes command-and-control over HTTP(S), historically favoring encoded/encrypted request and response bodies and, in many campaigns, decoy traffic to legitimate high-reputation domains (e.g., microsoft.com, bing.com) that return HTTP 404 while carrying disguised C2 data in the response body — a technique intended to blend malicious egress into background enterprise web traffic and defeat simple domain-reputation network controls. The 2022 sample set analyzed here communicated with a defined set of C2 IPs and a rotating pool of throwaway domains registered across cheap/free TLDs (.top, .tk, .ga, .ml, .tw, .ru, .co.ug) consistent with the bulletproof-hosting and disposable-domain patterns typical of SMOKY SPIDER's infrastructure.

SmokeLoader's downstream module ecosystem (documented broadly across the vendor/community corpus, not solely this sample) has historically included credential-stealing modules targeting browser-stored credentials and files containing unsecured credentials, local email collection, and the ability to fetch/execute follow-on payloads including information stealers (Lumma, RedLine, Vidar reported in later campaigns) and other loaders. Persistence in documented builds is commonly achieved through Registry Run key / Startup folder placement and, in some builds, Scheduled Task creation, ensuring re-execution across reboots without relying on the injected explorer.exe process alone.

Attribution: MITRE ATT&CK catalogs SmokeLoader as Software S0226; CrowdStrike attributes its development and criminal operation to SMOKY SPIDER, active since at least 2011, financially motivated, distributing the loader itself and reselling execution slots to third-party criminal customers. Malpedia additionally cross-references the UAC-0006 activity cluster (a financially motivated group targeting Ukrainian entities) as an observed operator/user of SmokeLoader builds.