Smoke Loader
Software · ATTACK:enterprise:S0226
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0226",
"title": "Smoke Loader",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0226",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--0c824410-58ff-49b2-9cf2-1c96b182bdf0",
"external_id": "S0226",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2024-04-11T00:04:55.094Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Smoke Loader"
},
{
"source_name": "Dofoil"
},
{
"source_name": "Malwarebytes SmokeLoader 2016",
"url": "https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/"
},
{
"source_name": "Microsoft Dofoil 2018",
"url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c4af99b-e82d-422f-86da-ccc94e55d763
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e5b4489-d480-4f42-aadb-0eeb45ad6bc0
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25d65c10-5fa3-40c1-9e25-936894446178
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4287de65-be1d-44aa-9c50-9c391e321597
Malwarebytes SmokeLoader 2016ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44aeb943-8861-4018-a93b-beeb393bfa8f
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46829b2b-0f05-4022-a254-e8b26fdfb860
Malwarebytes SmokeLoader 2016ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4929677b-3ce9-4065-9837-cfaa0cad8c89
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bb79228-9531-47c0-8e73-401e741593a8
Malwarebytes SmokeLoader 2016ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51cc7dff-7fb4-41bc-a67d-39598f14f1d8
Malwarebytes SmokeLoader 2016ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72cf04c6-5e0b-4743-9386-88f1f1f45899
Malwarebytes SmokeLoader 2016 · Microsoft Dofoil 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e809969-d903-4e58-b8a9-7344127da3cd
Talos Smoke Loader July 2018 · Malwarebytes SmokeLoader 2016ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95ed1db5-c388-4b1b-9824-9703b248f798
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3c37734-1f69-44ee-9e27-480ba68c79f4
Talos Smoke Loader July 2018ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7484ee2-6d98-4f5b-8788-2cf1675b349d
Talos Smoke Loader July 2018