SmokeLoader: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Custom pure C and Flat Assembler (FASM / MSVC /NODEFAULTLIB)",
  "runtime": "Native x86 assembly without C runtime libraries or static import tables",
  "binary_footprint": "Ultra-compact standalone executable, typ. 10 KB - 38 KB unpacked",
  "stub_size": "24,576 bytes (typical unpacked core loader), delivered via multi-stage crypters",
  "packer_obfuscation": "Self-modifying decryption loops, opaque predicates, encrypted API hashes, anti-dump memory wiping",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "Self-decrypting stub executes -> Resolves NTAPI functions via PEB traversal and ROR-13 hashing -> Executes anti-analysis checks (RDTSC, PEB flags, debug registers) -> Scans NTDLL exports for JMP/INT3 hooks, restoring clean opcodes -> Injects resident core into explorer.exe via NtAllocateVirtualMemory and NtWriteVirtualMemory -> Creates remote thread via RtlCreateUserThread -> Generates decoy HTTP requests -> Polls C2 for encrypted plugin payloads",
  "technical_summary": "SmokeLoader (also designated Dofoil) is a legendary headless modular malware loader and botnet stager authored in pure C and Assembly. It maintains an ultra-compact binary footprint with zero static import table dependencies, dynamically resolving all required Win32 and NTAPI functions using custom ROR-13 export name hashing. SmokeLoader is weaponized with an aggressive suite of anti-analysis capabilities, including unhooking user-mode monitoring agents, hardware breakpoint detection, RDTSC execution delta timing, and process injection into explorer.exe. It operates headlessly via underground PHP control panels, serving as a primary initial distribution vehicle for stealers, miners, and secondary botnet implants."
}

{
  "type": "Headless / CLI / Underground Web Panel (PHP/MySQL)",
  "builder_tabs": null,
  "config_fields": [
    {
      "offset": "0x0000",
      "field": "Campaign_Tag",
      "type": "DWORD / ASCII String",
      "description": "Affiliate campaign identifier"
    },
    {
      "offset": "0x0010",
      "field": "C2_URL_List",
      "type": "Encrypted String Array",
      "description": "List of authentic command-and-control server URLs"
    },
    {
      "offset": "0x0080",
      "field": "Decoy_URL_List",
      "type": "Encrypted String Array",
      "description": "List of legitimate third-party URLs used for traffic noise generation"
    },
    {
      "offset": "0x0120",
      "field": "RC4_Key",
      "type": "Byte Array (4-16 bytes)",
      "description": "Key utilized for network payload encryption and C2 response decryption"
    },
    {
      "offset": "0x0130",
      "field": "Polling_Delay",
      "type": "DWORD",
      "description": "Sleep interval in seconds between beaconing polling loops"
    }
  ],
  "payload_generation_flags": [
    "Target Architecture: x86 Native / WoW64 Compatible",
    "Unhooking Routine: NTDLL Syscall Restoration Active",
    "Injection Host: explorer.exe",
    "Decoy Generation: Active (Benign Web Queries)"
  ],
  "operator_commands": [
    "0x01: Download executable from URL and execute from disk",
    "0x02: Download reflective DLL plugin and execute in-memory",
    "0x03: Update bot binary to newer build version",
    "0x04: Execute arbitrary shellcode payload in remote thread",
    "0x05: Self-delete binary and terminate all resident threads"
  ],
  "interface_telemetry_analysis": "SmokeLoader is controlled via a centralized PHP/MySQL web panel. The panel displays active bot populations categorized by geographic location, operating system build, privilege level, and installation timestamp. Operators configure automated delivery tasks by specifying payload URLs, target filtering rules (geographic inclusion/exclusion), execution mechanisms (disk versus memory), and execution limits."
}

struct SmokeLoader_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Process Injection into explorer.exe: SmokeLoader obtains process ID of explorer.exe via Toolhelp32 or direct PEB traversal -> Opens target process using NtOpenProcess (PROCESS_ALL_ACCESS) -> Allocates memory space in explorer.exe via NtAllocateVirtualMemory (PAGE_EXECUTE_READWRITE) -> Copies resident core loop and plugin manager using NtWriteVirtualMemory -> Adjusts memory protection if necessary -> Spawns execution thread in explorer.exe via RtlCreateUserThread or NtCreateThreadEx -> Original stager terminates, leaving core loop running within legitimate process space.",
  "ntapi_functions": [
    "ntdll!NtOpenProcess",
    "ntdll!NtAllocateVirtualMemory",
    "ntdll!NtWriteVirtualMemory",
    "ntdll!NtProtectVirtualMemory",
    "ntdll!NtCreateThreadEx",
    "ntdll!RtlCreateUserThread",
    "ntdll!NtQueryInformationProcess"
  ],
  "process_hollowing_target": "C:\\Windows\\explorer.exe",
  "persistence_mechanics": [
    "Registry Run Key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to dropped stager",
    "Startup Folder: %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\[RandomName].exe",
    "Scheduled Task: Creation of task running under user context with random task naming"
  ],
  "evasion_hooks": [
    "API Export Unhooking: Scans NTDLL export stubs for 0xCC (INT3) or 0xE9 (JMP) hooks placed by security tooling, overwriting patched bytes with original syscall opcodes",
    "Dynamic API Resolution: Resolves APIs on the fly via ROR-13 export name hashing, presenting an empty Import Address Table (IAT)",
    "Decoy Traffic Cloaking: Transmits HTTP GET requests to legitimate benign domains to mask real C2 traffic"
  ],
  "anti_analysis": [
    "RDTSC execution latency delta loops detecting hypervisor single-stepping and emulation acceleration",
    "PEB!BeingDebugged, NtGlobalFlag, and ProcessDebugPort validation to detect attached debuggers",
    "Hardware breakpoint checks in DR0-DR3 registers via GetThreadContext",
    "Blacklisted module checks inspecting loaded libraries for sandbox DLLs (sbiedll.dll, snxhk.dll, dbghelp.dll)"
  ]
}

Concrete technical breakdown of functional modules implemented in the SmokeLoader binary:

{
  "framing": "HTTP POST requests directed to root URI or randomized paths on remote C2 servers. Requests are intermingled with decoy HTTP GET queries directed to legitimate third-party websites. POST bodies contain encrypted system fingerprint data.",
  "serialization": "Custom binary struct containing bot ID, OS build, architecture flags, and campaign tag, encrypted with RC4 and rolling XOR",
  "handshake": "Client generates bot registration data -> Encrypts block with RC4 using hardcoded key -> Applies rolling XOR or bitwise rotation -> Issues HTTP POST to C2 URL -> Server validates request and returns HTTP 200 with encrypted secondary payload or plugin DLL",
  "cryptography": "RC4 stream cipher utilizing a 4-16 byte hardcoded key, followed by a second layer of bitwise XOR transposition. Responses from the C2 are decrypted using the same RC4 key schedule.",
  "packet_types": [
    {
      "header": "POST /<path>/ HTTP/1.1",
      "payload": "Encrypted bot registration beacon containing HWID, OS version, and campaign tag",
      "direction": "Client -> Server"
    },
    {
      "header": "HTTP 200 OK",
      "payload": "RC4-encrypted task block containing command code and secondary binary URL/payload",
      "direction": "Server -> Client"
    },
    {
      "header": "POST /<path>/ (Status Report)",
      "payload": "Encrypted task execution status report confirming download or injection success",
      "direction": "Client -> Server"
    }
  ],
  "traffic_signature": "Outbound HTTP POST requests with Content-Type 'application/x-www-form-urlencoded' containing high-entropy binary buffers, accompanied by parallel HTTP GET queries to legitimate high-reputation domains."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: