SmokeLoader Malware Using Weaponized 7z Archive to Distribute Infostealers

A sophisticated malware campaign leveraging SmokeLoader has been identified targeting the First Ukrainian International Bank.

Attackers are using weaponized 7z archives as the initial attack vector, leading to the deployment of infostealer malware through a complex infection chain.

The attack employs a stealthy malware loader known as Emmenhtal, active since early 2024.

This loader serves as the distribution mechanism for infostealers including CryptBot and Lumma, with the current campaign specifically chaining it with SmokeLoader malware.

G Data Software security researchers identified that the infection begins with a deceptive email containing a 7z archive named ‘Платіжна_інструкция.7z’ (Payment_instruction).

Upon extraction, victims find a bait PDF document alongside a malicious shortcut file that initiates the infection sequence by retrieving additional components from remote servers at 194.87.31.68 and 88.151.192.165.

Infection Mechanism Analysis

The infection mechanism employs sophisticated techniques to maintain stealth. When the victim opens the shortcut file, it triggers a chain utilizing PowerShell and Mshta to download malicious code.

The attack leverages a modified version of Windows’ built-in DCCW.exe (Display Color Calibration Wizard), exemplifying a LOLBAS technique that minimizes detection footprint.

The malicious HTA script contains obfuscated JavaScript that decodes to reveal additional PowerShell commands:-

powershell.exe -w 1 -ep Unrestricted -nop $ydbF = 'CECA99D6CDC9BCCAD9D2C7D8CDD3D284D1AECA8C88ABB0DA908488C6CBD08DDFD7C78488ABB0DA8488C6CBD08491A9DZC-1I'

The PowerShell component downloads two files: a lure PDF (invoce1202.pdf) and the SmokeLoader malware (putty1202.exe).

Analysis reveals the use of .NET Reactor for obfuscation, representing a shift from SmokeLoader’s historical use of other packers.

Once executed, SmokeLoader exhibits modular capabilities including credential theft from browsers, remote command execution from its C2 server, and process injection techniques for evading detection and analysis.

Organizations should implement robust endpoint security, EDR solutions, and network monitoring to detect such LOLBAS techniques.

The presence of this campaign highlights the continued evolution of financially motivated threat actors who leverage increasingly sophisticated techniques to deliver their malicious payloads while evading security controls.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free