Dissecting Smoke Loader

This report dissects the Smoke Loader (Dofoil) malware, showing its layered unpacking, anti-analysis and anti-VM checks, custom import resolution, RC4 and XOR string/encryption routines, propagation/injection methods (including PROPagate), C2 packet formats and algorithms, and practical IOCs (file paths, startup persistence, registry checks, and HTTP request patterns) observed in active RigEK and malspam campaigns.