Smokeloader is a popular bot and a veteran in its field, this piece of malware is used mainly for loading other malicious software, usually obtained from a third party. At the same time, it has the capability of loading its own modules, allowing it to conduct a variety of actions without the usage of external components. The seller of Smokeloader (which is known by the handle SmokeLdr) is active in providing this malware as a service to this date.
In order to avoid detection, Smokeloader first creates a new copy of ntdll.dll as a temporary file with a hardcoded name in the %APPDATA%\Local\Temp directory and then loads it using LdrLoadDll. Following this, it resolves all the functions it requires for its own usage and invokes them from the new copy of ntdll in its memory.
In addition to the anti-debug checks used in the older version of Smokeloader, the author added another method, which is rather well known. He made the malware call the API function NtQueryInformationProcess from the copy of ntdll, with an information class argument called ProcessDebugPort. The result provided by the function indicates if the debug port is used in the malware’s process, i.e. a debugger is attached to it. In the case that a non-null value is retrieved by this function, Smokeloader determines that it is indeed run by a debugger (and likely by a researcher), hence aborts its execution.
Exposure of sensitive information
Indicators of Compromise
Malware Hash (MD5/SHA1/SH256)