SmokeLoader History, Part 2

SmokeLoader version 2018 introduced a major stager redesign that moves extensive anti-analysis and injection logic into the stager: nested XOR encrypted code blocks, code-permutation and opaque-predicate obfuscation, DJB2-based API hashing, keyboard/OS checks, PROPagate injection into explorer.exe (x86/x64 aware), LZNT1/RtlDecompressBuffer decompression, modified C2 XOR encryption, and scheduled-task persistence—collectively increasing the loader's stealth and flexibility.