SmokeBuster

This report analyzes SmokeLoader (2018–2022), describing how its stager and main module operate, how persistence is achieved via a scheduled task executed every 10 minutes, and how coding errors cause repeated injections into explorer.exe and the creation of persistent anti-analysis threads that are not cleaned up—resulting in progressive resource exhaustion and severe system slowdown on infected hosts.