{
  "family": "dofoil",
  "sample_count": 90,
  "category": "downloader",
  "description": "Dofoil (universally tracked across threat intelligence communities and security vendors under aliases including SmokeLoader, Smoke Loader, and Trojan:Win32/Dofoil) is a notorious, modular initial access malware loader active since at least 2011. Sold on Russian-language underground cybercrime forums as a commercial Malware-as-a-Service (MaaS) payload loader, Dofoil served as the primary gateway infection for distributing ransomware, banking trojans, cryptocurrency miners, and info-stealers across global enterprise and consumer endpoints. Dofoil was a primary target of the major 2024 international law enforcement takedown known as 'Operation Endgame'. To maintain stealth, Dofoil injects its payload stub directly into legitimate Windows processes (most commonly explorer.exe) and manually reloads a fresh copy of ntdll.dll from disk directly into memory to overwrite and bypass user-mode API monitoring hooks established by Endpoint Detection and Response (EDR) solutions. In addition, Dofoil generates decoy HTTP requests to benign domains (such as microsoft.com and google.com) interspersed with encrypted command-and-control beacons to camouflage its network footprint.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Dofoil",
    "SmokeLoader",
    "Smoke Loader",
    "TrojanDownloader:Win32/Dofoil"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Dofoil (SmokeLoader)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dofoil, widely known as SmokeLoader, is a commercial modular loader used by cybercriminals to deliver secondary ransomware and stealer payloads."
      }
    },
    {
      "@type": "Question",
      "name": "What international law enforcement operation targeted Dofoil infrastructure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In May 2024, international law enforcement agencies disrupted SmokeLoader and related botnets during 'Operation Endgame'."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dofoil evade Endpoint Detection and Response (EDR) tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It reloads an unhooked copy of ntdll.dll from disk into memory to strip user-mode API hooks placed by security agents."
      }
    },
    {
      "@type": "Question",
      "name": "Which legitimate Windows process is typically targeted for injection by Dofoil?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dofoil predominantly injects its decrypted payload code into explorer.exe to mask its execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dofoil camouflage its network command-and-control traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It sends rapid decoy HTTP requests to high-reputation domains like Google and Microsoft alongside its encrypted C2 traffic."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1055.001",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1027",
    "T1036.004",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; a Dofoil/Smoke Loader infection almost guarantees the presence of severe secondary payloads like ransomware.",
    "Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident payloads.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Dofoil persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Dofoil dropper was quarantined; the payload often executes purely in memory.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Weaponized Office Macro Documents",
    "Pirated Software & Cracks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Process Injection into explorer.exe",
    "EDR Hook Bypassing (ntdll unhooking)",
    "Decoy Network Traffic Generation",
    "Modular Plugin Execution",
    "Secondary Malware Staging"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons with RC4-encrypted payload buffers to C2 servers",
      "Simultaneous benign GET requests to high-profile web services"
    ],
    "evasion_techniques": [
      "Direct memory mapping of ntdll.dll to overwrite hooked system APIs",
      "Anti-debugging API checks (IsDebuggerPresent, CheckRemoteDebuggerPresent)"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SmokeLoader",
      "Scheduled Task launching dropper from %AppData%"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Complete host compromise, secondary ransomware deployment, lateral movement staging"
  },
  "lineage": {
    "derived_from": [
      "Underground Russian MaaS Loaders"
    ],
    "variants": [
      "SmokeLoader 2014",
      "SmokeLoader 2018",
      "SmokeLoader 2024"
    ]
  },
  "iocs": {
    "file_hashes": [
      "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
      "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
    ],
    "delivery": [
      "invoice_scan.docm",
      "smoke_loader.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DofoilLoader",
      "%AppData%\\Dofoil\\explorer_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Huntress Threat Research - Deconstructing SmokeLoader / Dofoil",
      "url": "https://www.huntress.com/blog"
    },
    {
      "name": "Zscaler ThreatLabz - SmokeLoader Analysis & Operation Endgame",
      "url": "https://www.zscaler.com/blogs/security-research"
    }
  ]
}