Hackers misuse malware for diverse illicit intentions, including data theft, disrupting systems, espionage, or distortion for unethical monetary benefits.
Besides this malware is also helpful in conducting cyber warfare or receptive intelligence by the nation-state actors of a certain country as well.
SmokeLoader is a versatile and modular malware initially functioning as a downloader. It has evolved into a sophisticated framework with information-stealing capabilities.
Over the years, it’s been undergoing significant development. Zscaler ThreatLabz’s analysis supported Operation Endgame in 2024, disinfecting tens of thousands of infections, and has documented SmokeLoader’s versions extensively.
Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot.
SmokeLoader – A Modular Malware
Starting from 2011, the earliest SmokeLoader samples without any version numbers were quite simple but laid down a base for C2 client communication.
These “prehistoric” variants had two shellcodes injected into svchost.exe processes that included one with “getload” or “getgrab” commands for querying the C2 server and the other registering bot using HTTP GET requests.
Malware has undergone different injection techniques ranging from shared sections to APC queue injection.
Although simple in nature, these initial steps set a foundation for the subsequent development of SmokeLoader into modular and advanced threats.
.webp "A Modular Malware With Range Of Capabilities 1")
The SmokeLoader 2012 panel leaked source code showed that it supported different commands, including “getgrab” for retrieving a module used to steal information and “getshell” for implementing a remote shell.
Hash-based API resolution, string encryption, and others were built to prevent the analysis process.
By 2014, significant changes had been implemented in the SmokeLoader program, such as a multi-stage loading process, an updated bot ID generation algorithm, a separate encrypted C2 list, and a new stager component.
That is why the next versions of the malware stealing part will be separated into standalone plugins with multifunctional options for proper execution.
This illustrated that SmokeLoader was never static but always developing with more sophisticated evasions and expanding its features.
In SmokeLoader version 2014, the stager component contains the main module’s decryption and decompression function.
It also executes a few anti-analysis checks and injects the malware into svchost.exe via APC queue code injection.
The essential obfuscation techniques applied include non-polymorphic decryption loops and string encryption.
It was modified to allow persistence, updated its bot ID generation algorithm, kept strings in plain text, implemented environment checks against analysis tools, and introduced a copy-protection mechanism based on CRC32 values.
The network protocol was changed so encrypted commands and arguments could be sent via HTTP POST requests.
This marks one of the significant evolutionary advancements made by SmokeLoader.
Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free