MITRE ATT&CKsoftware (malware)
S0226 Smoke Loader
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Dofoil
- Version
- 1.3
- Created
- 2018-04-18
Description
Smoke Loader is a malicious bot application that can be used to load other malware.
Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins.
Related
Uses · MITRE ATT&CK (14)
- T1027.013 Encrypted/Encoded File sub-technique
- T1071.001 Web Protocols sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
- T1114.001 Local Email Collection sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1552.001 Credentials In Files sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.012 Process Hollowing sub-technique
- T1053.005 Scheduled Task sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1055 Process Injection technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/ Malwarebytes SmokeLoader 2016
- https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/ Microsoft Dofoil 2018