Smoke Loader
- ID
- S0226
- Type
- Malware
- Associated names
- Dofoil
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 11 Apr 2024
Smoke Loader is a malicious bot application that can be used to load other malware.
Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins. [1] [2]
Techniques used (14)
- T1027.013 Encrypted/Encoded File
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1055.012 Process Hollowing
- T1059.005 Visual Basic
- T1071.001 Web Protocols
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1114.001 Local Email Collection
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1547.001 Registry Run Keys / Startup Folder
- T1552.001 Credentials In Files
- T1555.003 Credentials from Web Browsers