UAC-0006

Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0

Technical Analysis of SmokeLoader Version 2025 | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Analysis of SmokeLoader Version 2025 | ThreatLabz

Untitled

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Untitled

Operation Endgame: Do Takedowns and Arrests Matter?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Endgame: Do Takedowns and Arrests Matter?

Operation Endgame follow-up leads to five detentions and interrogations as well as server takedowns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Endgame follow-up leads to five detentions and interrogations as well as server takedowns

TLP-CLEAR-From-espionage-to-PsyOps-Tracking-operations-and-infrastructure-of-UACs-in-2025-EN-1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TLP-CLEAR-From-espionage-to-PsyOps-Tracking-operations-and-infrastructure-of-UACs-in-2025-EN-1.pdf

SmokeLoader Malware Targets Ukraine’s Auto & Banking Sectors via Open Directories

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SmokeLoader Malware Targets Ukraine’s Auto & Banking Sectors via Open Directories

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

TLP-CLEAR-CryptBot-Hunting-for-intial-access-vectors.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TLP-CLEAR-CryptBot-Hunting-for-intial-access-vectors.pdf

SmokeLoader Attack Targets Companies in Taiwan | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SmokeLoader Attack Targets Companies in Taiwan | FortiGuard Labs

FortiMail Workspace Security | Fortinet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FortiMail Workspace Security | Fortinet

Correlating Vidar Stealer Build IDs Based on Loader Tasks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Correlating Vidar Stealer Build IDs Based on Loader Tasks

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure

SmokeLoader History | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SmokeLoader History | ThreatLabz

Largest ever operation against botnets hits dropper malware ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Largest ever operation against botnets hits dropper malware ecosystem

Taking a deep dive into SmokeLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Taking a deep dive into SmokeLoader

CrackedCantil: Malware Work Together

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CrackedCantil: Malware Work Together

Understanding Internals of SmokeLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Internals of SmokeLoader

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Gamaredon_activity, копия

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gamaredon_activity, копия

8Base ransomware stays unseen for a year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 8Base ransomware stays unseen for a year

8Base Ransomware: A Heavy Hitting Player

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 8Base Ransomware: A Heavy Hitting Player

Malware Analysis and Deobfuscation With Procmon - Smokeloader Example

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis and Deobfuscation With Procmon - Smokeloader Example

RIG___TLP_CLEAR-1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RIG___TLP_CLEAR-1.pdf

Malicious Packer pkr_ce1a

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious Packer pkr_ce1a

Trellix Insights: SmokeLoader Exploits Old Vulnerabilities to Drop zgRAT

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Trellix Insights: SmokeLoader Exploits Old Vulnerabilities to Drop zgRAT

Seychelles, Seychelles, on the C(2) Shore

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Seychelles, Seychelles, on the C(2) Shore

NullMixer: oodles of Trojans in a single dropper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NullMixer: oodles of Trojans in a single dropper

PrivateLoader: the loader of the prevalent ruzki PPI service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: the loader of the prevalent ruzki PPI service

Tracking PrivateLoader: Malware Distribution Service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking PrivateLoader: Malware Distribution Service

Quick-Analysis/SmokeLoader/SmokeLoader.md at main · vc0RExor/Quick-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick-Analysis/SmokeLoader/SmokeLoader.md at main · vc0RExor/Quick-Analysis

SmokeLoader Triage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SmokeLoader Triage

An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

Life After Death—SmokeLoader Continues to Haunt Using Old Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Life After Death—SmokeLoader Continues to Haunt Using Old Vulnerabilities

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Identifying PrivateLoader Network Threats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying PrivateLoader Network Threats

Amadey Bot Being Distributed Through SmokeLoader - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Amadey Bot Being Distributed Through SmokeLoader - ASEC

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

SystemBC Being Used by Various Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SystemBC Being Used by Various Attackers

New Golang botnet empties Windows users’ cryptocurrency wallets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Golang botnet empties Windows users’ cryptocurrency wallets

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

PrivateLoader: The first step in many malware schemes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: The first step in many malware schemes

A Deep Dive into Packing Software CryptOne

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Packing Software CryptOne

Look how many cybercriminals love Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Look how many cybercriminals love Cobalt Strike

PaaS, or how hackers evade antivirus software

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PaaS, or how hackers evade antivirus software

report-bb-2021-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf

CopperStealer: Password & Cookie Stealer Malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CopperStealer: Password & Cookie Stealer Malware | Proofpoint US

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

Analytics

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Analytics

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog

GCleaner — Garbage Provider Since 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GCleaner — Garbage Provider Since 2019

2020: The year in malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2020: The year in malware

Smokeloader is still alive and kickin’ – A new way to encrypt CC server URLs

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Smokeloader is still alive and kickin’ – A new way to encrypt CC server URLs

Malvertising campaigns come back in full swing | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malvertising campaigns come back in full swing | Malwarebytes Labs

Malvertising campaigns come back in full swing

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malvertising campaigns come back in full swing

Salfram: Robbing the place without removing your name tag

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Salfram: Robbing the place without removing your name tag

Hatching - Automated malware analysis solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hatching - Automated malware analysis solutions

Deep Analysis of SmokeLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of SmokeLoader

Operation TA505: network infrastructure. Part 3

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Operation TA505: network infrastructure. Part 3

Examining Smokeloader’s Anti Hooking technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Examining Smokeloader’s Anti Hooking technique

Smoke Loader Malware – An Easy Guide 101

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoke Loader Malware – An Easy Guide 101

The 2019 Resurgence of Smokeloader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The 2019 Resurgence of Smokeloader

2019: The Return of Retefe | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2019: The Return of Retefe | Proofpoint US

Analysis of Smoke Loader in New Tsunami Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Smoke Loader in New Tsunami Campaign

A taste of our own medicine : How SmokeLoader is deceiving configuration extraction by using binary code as bait • Raashid Bhat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A taste of our own medicine : How SmokeLoader is deceiving configuration extraction by using binary code as bait • Raashid Bhat

Dissecting Smoke Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting Smoke Loader

Smoking Guns - Smoke Loader learned new tricks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Guns - Smoke Loader learned new tricks

Malware | Smoke Loader malware improves after Microsoft spoils its Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware | Smoke Loader malware improves after Microsoft spoils its Campaign

Hunting down Dofoil with Windows Defender ATP | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting down Dofoil with Windows Defender ATP | Microsoft Security Blog

Fake Spectre and Meltdown patch pushes Smoke Loader malware | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Spectre and Meltdown patch pushes Smoke Loader malware | Malwarebytes Labs

Crystal Finance Millennium used to spread malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Crystal Finance Millennium used to spread malware

New-looking Sundown EK drops Smoke Loader, Kronos banker | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New-looking Sundown EK drops Smoke Loader, Kronos banker | Malwarebytes Labs

Smoke Loader - downloader with a smokescreen still alive | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoke Loader - downloader with a smokescreen still alive | Malwarebytes Labs

Dissecting SmokeLoader (or Yulia's sweet ass proposition)

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Dissecting SmokeLoader (or Yulia's sweet ass proposition)