SmokeLoader backdoor is a malicious application that aims at giving the attacker remote access to your PC. The general purpose of such access in the case of this backdoor is to download different other malware. Despite being very old, it is still a tough nut, and remains active and popular in attacks of different profiles. Let’s check out why SmokeLoader is so potent despite its venerable age.

What is backdoor malware?

Before getting into SmokeLoader analysis, let’s have a look at what backdoors are. This malware type has a long and curved story, and these days is an eminence grise. The key target of backdoor malware is to create a way for cybercriminals to remotely connect to the target PC and perform any possible actions. For that purpose, they never disdain to use vulnerabilities in the targeted system, along with injecting into the system as a trojan.

The main use for backdoor-infected computers is their participation in the botnet. Huge networks of zombie systems that perform DDoS attacks, send spam emails and do other nefarious activities are well known over the last decade. For that purpose scoundrels use automated backdoors – the ones which require minimum commands from the command and control server and may run on their own. The other application of a backdoor – exactly, the manually-controlled one – is data stealing and malware implementation. As in the latter case backdoor acts as a locomotive for malicious payload, it is sometimes classified as a worm.

SmokeLoader malware description

SmokeLoader backdoor first appeared in 2014 – at the very beginning of the ransomware era. Only a few other malware can boast of remaining active through 8 years after their launch. This backdoor has a lot of features that allow it to remain actual despite being so old. First and foremost, it is extremely small – the payload is only about 30 kilobytes. Regular malware of that type usually has a file size of at least 100 KB, usually around 150-200 kilobytes. That already makes it way easier to handle in a protected system, as some YARA rules used for malware detection pay attention to the file size.

Another feature, that distinguishes it among others, is that it is written in C and Assembly languages. Both of them are low-level, which points to their ability to dig very deep into the system. The exact code of this backdoor is heavily obfuscated. It was an effective measure against anti-malware programs, but these days any kind of obfuscation detected is considered hazardous. These days, it just makes reverse engineering this malware much more difficult.

Key features of this backdoor are wrapped around its loader functions, as you may have supposed from its name. The vast majority of time, SmokeLoader is used to deliver other malware to the infected system. Still, it is not the sole purpose of this malware – continuous development brought the ability to use it as a stealing tool. It also suits botnet deployment – but there are only a few cases of such usage. It still receives updates each year, so its functionality may extend in future.