LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0226: Smoke Loader

Smoke Loader is a malicious bot application that can be used to load other malware. Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins. [1] [2]

EnterpriseS0226MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Smoke Loader matters because it is a Windows malicious bot/downloader that can bring additional malware into an environment. For leaders, the risk is less about one named tool and more about whether the organization can quickly identify a foothold that uses deception, self-protection, persistence, web-based command-and-control, credential collection, and follow-on payload transfer.

Executive priority

Prioritize Smoke Loader as a resilience and incident-readiness test case: can the business detect and contain a Windows host that becomes a staging point for additional malware? Executive questions should focus on endpoint visibility, persistence monitoring, credential exposure from browsers/files, email data protection, and whether SOC/IR playbooks treat downloader activity as a potential precursor to broader compromise.

Technical view

ATT&CK provides no official detection text for S0226, so coverage should be validated through the related behaviors: encrypted or encoded files, deobfuscation, scheduled tasks, Registry Run Keys or Startup Folder persistence, process injection/process hollowing, Visual Basic execution, web protocol C2, ingress tool transfer, file and directory discovery, local email collection, credential access from files and browsers, and system checks used for sandbox or analysis avoidance. Because the software platform is Windows, validation should center on Windows endpoint, process, registry, task scheduler, file, browser credential store, email cache, and network telemetry.

Likely telemetry

  • Windows process creation and parent/child process lineage
  • Command-line and script execution telemetry, including Visual Basic-related execution where available
  • Task Scheduler creation, modification, and execution events
  • Registry Run Key and Startup Folder change events
  • Endpoint memory/injection or suspicious process behavior alerts

Detection direction

  • Do not rely on a single malware signature; validate behavior-based coverage across persistence, injection, web C2, and payload download patterns.
  • Tune scheduled task and Run Key detections for newly created or unusual entries, while accounting for legitimate software updaters and administrative automation.
  • Correlate process injection or process hollowing signals with suspicious network activity, decoded payload artifacts, or unexpected child processes to reduce false positives.
  • Review whether encrypted/encoded files and deobfuscation events are visible before execution, not only after payload delivery.
  • Validate visibility into credential-related file access, especially browser credential stores and locally stored credentials, because collection behaviors may be quiet and host-local.

Mitigation priorities

  • Start with endpoint prevention and monitoring controls on Windows systems, especially for suspicious persistence, injection, scripting, and downloaded payload execution.
  • Harden and monitor credential storage practices: reduce insecure credentials in files and limit exposure from browser-saved credentials where business processes allow.
  • Restrict unnecessary script and automation abuse paths, while maintaining exceptions for approved administrative workflows.
  • Improve egress monitoring for endpoint web-protocol traffic so unusual command-and-control or payload retrieval can be investigated quickly.
  • Ensure IR playbooks treat downloader findings as potentially incomplete until follow-on payloads, credential access, persistence, and local collection are ruled out.
Additional notes and limits

Smoke Loader is described by ATT&CK as a malicious bot application used to load other malware, observed since at least 2011, with deception, self-protection, and plug-ins. The most useful defensive value comes from the relationship set: it maps the malware to behaviors spanning execution, persistence, stealth, discovery, command-and-control, collection, and credential access.

ATT&CK provides no official detection guidance, no aliases, and no object-level tactics for S0226 in the supplied fields. The relationship techniques describe relevant behaviors but do not prove every behavior will appear in every incident. Local endpoint, network, identity, and IR evidence is required to assess exposure or confirm activity.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Smoke Loader

Smoke Loader is a malicious bot application that can be used to load other malware. Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins. [1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

14 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or Information

Smoke Loader deobfuscates its code.[3]

EnterpriseT1552.001Credentials In FilesSub-technique

Smoke Loader searches for files named logins.json to parse for credentials.[3]

EnterpriseT1114.001Local Email CollectionSub-technique

Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).[3]

EnterpriseT1059.005Visual BasicSub-technique

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Smoke Loader searches for credentials stored from web browsers.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

Smoke Loader uses HTTP for C2.[1]

EnterpriseT1497.001System ChecksSub-technique

Smoke Loader scans processes to perform anti-VM checks. [3]

EnterpriseT1105Ingress Tool Transfer

Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.[1]

EnterpriseT1055.012Process HollowingSub-technique

Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.[1][2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.[1][3]

EnterpriseT1055Process Injection

Smoke Loader injects into the Internet Explorer process.[3]

EnterpriseT1053.005Scheduled TaskSub-technique

Smoke Loader launches a scheduled task.[3]

EnterpriseT1083File and Directory Discovery

Smoke Loader recursively searches through directories for files.[3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1114.001: Local Email CollectionEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
5a141bf85f68c74c...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundle5a141bf85f68…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  2. [2]
    Microsoft Dofoil 2018

    Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.

    Open source URL
  3. [3]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  4. [4]
    Dofoil

    (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)

  5. [5]
    Dofoil

    (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)

  6. [6]
    Dofoil

    (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)

  7. [7]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  8. [8]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  9. [9]
    Microsoft Dofoil 2018

    Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.

    Open source URL
  10. [10]
    Microsoft Dofoil 2018

    Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.

    Open source URL
  11. [11]
    Smoke Loader

    (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)

  12. [12]
    Smoke Loader

    (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)

  13. [13]
    Smoke Loader

    (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)

  14. [14]
    mitre-attackS0226
    Open source URL
  15. [15]
    mitre-attackS0226
    Open source URL
  16. [16]
    mitre-attackS0226
    Open source URL
  17. [17]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  18. [18]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  19. [19]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  20. [20]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  21. [21]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  22. [22]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  23. [23]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  24. [24]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  25. [25]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  26. [26]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  27. [27]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  28. [28]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  29. [29]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  30. [30]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  31. [31]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  32. [32]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  33. [33]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  34. [34]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  35. [35]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  36. [36]
    Microsoft Dofoil 2018

    Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.

    Open source URL
  37. [37]
    Microsoft Dofoil 2018

    Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.

    Open source URL
  38. [38]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  39. [39]
    Malwarebytes SmokeLoader 2016

    Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.

    Open source URL
  40. [40]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  41. [41]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  42. [42]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  43. [43]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  44. [44]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
  45. [45]
    Talos Smoke Loader July 2018

    Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use