S0226 - Smoke Loader

Name: S0226 - Smoke Loader
Creator: Maltiverse
Published: 2023-03-27

Smoke Loader is a malicious bot application that can be used to load other malware.Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins.

Author: agomez
Created: 2023-03-27 16:11:52
Last updated: 2026-02-07 18:56:37
Downloads: 365429
IPv4 indicators: 1
Hostname indicators: 83
URL indicators: 9
Sample indicators: 645

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

publicitycharetew.shop Hostname

modified 2026-10-17 10:47:53
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

leafcalfconflcitw.shop Hostname

modified 2026-10-17 10:17:19
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

omfghellobrosjda38.org Hostname

modified 2026-10-17 08:44:42
SmokeLoader (ThreatFox Abuse.ch)

injurypiggyoewirog.shop Hostname

modified 2026-10-17 08:41:49
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

summerwaterhall.com Hostname

modified 2026-10-17 08:41:23
SmokeLoader (ThreatFox Abuse.ch)

goodlenuxilam.site Hostname

modified 2026-10-17 08:40:51
SmokeLoader (ThreatFox Abuse.ch) · Malicious behavior (Maltiverse Threat Observatory)

baxe.pics Hostname

modified 2026-10-17 08:40:43
Smokeloader (Maltiverse Threat Observatory) · Remus (ThreatFox Abuse.ch) · Tofsee (Maltiverse Threat Observatory) · remusstealer (Maltiverse Threat Observatory)

blogstatserv25.xyz Hostname

modified 2026-10-17 08:37:58
SystemBC (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

e5e0109aad61263d4ce63987f6be1fa8cf0063bcc95dde23afa1c7bcccded8e7 Sample

modified 2026-10-17 07:21:46
SmokeLoader (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

9c2fc7a80d11b3eb2444b4afce3580b5cb6c437ea6dbf1abfc32d2d85e656d19 Sample

modified 2026-10-17 07:21:15
SmokeLoader (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

9bf98f1144447c1d5a6332648f2e5b192ca7c67279e6b0c052b23644c837eb02 Sample

modified 2026-10-17 06:30:33
SmokeLoader (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

spasopro.at Hostname

modified 2026-10-17 06:19:20
Amadey (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch) · Malware Download (URLhaus Abuse.ch) · Malicious behavior (Maltiverse Threat Observatory) · Trojan.generic (Maltiverse Threat Observatory)

liubertiyyyul.net Hostname

modified 2026-10-17 04:40:19
SmokeLoader (ThreatFox Abuse.ch)

rosatiauto.com Hostname

modified 2026-10-17 04:38:44
SmokeLoader (ThreatFox Abuse.ch)

94692818ab0aadff6bcb86a61a7ae5397b1e64c83588a1a9e88071160c8f03b2 Sample

modified 2026-10-17 03:06:22
SmokeLoader (Cyber Threat Alliance)

d62f21ad408de5b6a88abfb81d7b898b6943fb391249617a787ffaafd8715314 Sample

modified 2026-10-17 01:47:49
SmokeLoader (Cyber Threat Alliance)

silentfus.com Hostname

modified 2026-10-17 00:40:14
SmokeLoader (ThreatFox Abuse.ch)

vacantion18ffeu.cc Hostname

modified 2026-10-17 00:39:23
SmokeLoader (ThreatFox Abuse.ch)

cinems.club Hostname

modified 2026-10-17 00:38:01
SmokeLoader (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

airwide-land.com Hostname

modified 2026-10-17 00:37:59
SmokeLoader (ThreatFox Abuse.ch)

wirtshauspost.at Hostname

modified 2026-10-17 00:36:04
SmokeLoader (ThreatFox Abuse.ch)

tradein-myus.com Hostname

modified 2026-10-17 00:36:03
SmokeLoader (ThreatFox Abuse.ch)

tvqaq.cn Hostname

modified 2026-10-17 00:35:42
SmokeLoader (ThreatFox Abuse.ch)

doughtdrillyksow.shop Hostname

modified 2026-10-17 00:34:32
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

msgrouppolicy.vg Hostname

modified 2026-10-17 00:12:35
Exploit.Kitmalware (Maltiverse Threat Observatory) · Smokeloader (Maltiverse Threat Observatory) · Malicious behavior (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory) · win.count.loader (Maltiverse Threat Observatory)

facilitycoursedw.shop Hostname

modified 2026-10-16 21:52:36
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

c9757ad509edeafb40df2f0b5b918df6df585842f3570a7f6ac2ad37ff7e81dc Sample

modified 2026-10-16 21:17:50
SmokeLoader (Cyber Threat Alliance)

8c1798da33f4da8f3aa5d6becdc418275b5050a6b24d57412b28657cf0ac1104 Sample

modified 2026-10-16 20:44:37
SmokeLoader (Cyber Threat Alliance)

servermlogs27.xyz Hostname

modified 2026-10-16 20:40:41
SmokeLoader (ThreatFox Abuse.ch)

trybobry.com.ua Hostname

modified 2026-10-16 20:35:42
SmokeLoader (ThreatFox Abuse.ch)

provisjournal.com Hostname

modified 2026-10-16 20:35:38
SmokeLoader (ThreatFox Abuse.ch)

fightwa.biz Hostname

modified 2026-10-16 20:35:14
Smokeloader (Maltiverse Threat Observatory) · remusstealer (Maltiverse Threat Observatory)

miami-golf-club.com Hostname

modified 2026-10-16 20:35:08
SmokeLoader (ThreatFox Abuse.ch)

humman.art Hostname

modified 2026-10-16 20:35:08
SmokeLoader (ThreatFox Abuse.ch)

greenco2020.top Hostname

modified 2026-10-16 20:34:53
SmokeLoader (ThreatFox Abuse.ch) · Agent Tesla (Maltrail) · Top Popularity Site (Cisco Umbrella) · Malicious behavior (Maltiverse Threat Observatory)

galandskiyher5.com Hostname

modified 2026-10-16 20:21:24
Malicious URL (Hybrid-Analysis) · Malware Download (URLhaus Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

admlogs77x.online Hostname

modified 2026-10-16 20:20:26
SmokeLoader (ThreatFox Abuse.ch)

https://helpsscodds.in/cms/ URL

modified 2026-10-16 18:37:00
SmokeLoader (ThreatFox Abuse.ch)

olihonols.in.net Hostname

modified 2026-10-16 16:37:56
SmokeLoader (ThreatFox Abuse.ch)

soetegem.com Hostname

modified 2026-10-16 16:37:56
SmokeLoader (ThreatFox Abuse.ch)

msktk.ru Hostname

modified 2026-10-16 16:37:56
SmokeLoader (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

misipu.cn Hostname

modified 2026-10-16 16:37:45
SmokeLoader (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

nusdhj.ws Hostname

modified 2026-10-16 16:35:51
SmokeLoader (ThreatFox Abuse.ch)

wa5zu7sekai8xeih.com Hostname

modified 2026-10-16 16:35:37
SmokeLoader (ThreatFox Abuse.ch)

vues3d.com Hostname

modified 2026-10-16 16:35:24
SmokeLoader (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

blogmstat255.xyz Hostname

modified 2026-10-16 16:35:04
SmokeLoader (ThreatFox Abuse.ch)

admlogs85x.xyz Hostname

modified 2026-10-16 16:34:23
SmokeLoader (ThreatFox Abuse.ch)

gebeus.ru Hostname

modified 2026-10-16 16:33:02
SmokeLoader (ThreatFox Abuse.ch)

gudintas.at Hostname

modified 2026-10-16 16:33:01
SmokeLoader (ThreatFox Abuse.ch)

gmpeople.com Hostname

modified 2026-10-16 16:32:57
SmokeLoader (ThreatFox Abuse.ch)

galala.ru Hostname

modified 2026-10-16 16:17:58
SmokeLoader (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

tnc-corp.ru Hostname

modified 2026-10-16 16:04:53
SmokeLoader (ThreatFox Abuse.ch)

noblecreativeaz.com Hostname

modified 2026-10-16 16:04:45
SmokeLoader (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

f7f3a1bac9af17d949f47e649063897717ca7873b4b818e0cad1c5037bdea056 Sample

modified 2026-10-16 14:58:51
SmokeLoader (Cyber Threat Alliance)

witra.ru Hostname

modified 2026-10-16 14:52:41
SmokeLoader (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

nuljjjnuli.org Hostname

modified 2026-10-16 14:38:10
SmokeLoader (ThreatFox Abuse.ch)

4d714ea6c158a636dc7659cda0eb636feac1c81baeec91824ad651fb68b86fdc Sample

modified 2026-10-16 13:10:39
SmokeLoader (Cyber Threat Alliance)

hoh0aeghwugh2gie.com Hostname

modified 2026-10-16 12:38:34
SmokeLoader (ThreatFox Abuse.ch)

tonybabb.com Hostname

modified 2026-10-16 12:37:30
SmokeLoader (ThreatFox Abuse.ch)

seattle-fishing-club.com Hostname

modified 2026-10-16 12:37:25
SmokeLoader (ThreatFox Abuse.ch)

f47841d10f35512801d6180f1c7f9153bbbe2e9ab4572517ff91edef3fd172ac Sample

modified 2026-10-16 12:36:48
SmokeLoader (Cyber Threat Alliance)

trad-einmyus.com Hostname

modified 2026-10-16 12:36:37
SmokeLoader (ThreatFox Abuse.ch)

admlogs.online Hostname

modified 2026-10-16 12:36:27
SystemBC (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

outcrol.biz Hostname

modified 2026-10-16 12:35:13
Smokeloader (Maltiverse Threat Observatory) · Remus (ThreatFox Abuse.ch)

bargainnygroandjwk.shop Hostname

modified 2026-10-16 12:34:30
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

demblog575.xyz Hostname

modified 2026-10-16 12:34:04
SmokeLoader (ThreatFox Abuse.ch)

atlanta-newspaper.com Hostname

modified 2026-10-16 12:34:02
SmokeLoader (ThreatFox Abuse.ch)

disappointcredisotw.shop Hostname

modified 2026-10-16 12:33:40
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

e5c861842c2b9a2fc93dca27b5bd91cac00982aefdee918c8d4ed49418a4f359 Sample

modified 2026-10-16 12:15:08
SmokeLoader (Cyber Threat Alliance)

228f747feb0e0f0bf5227027aaf7c54e4118e706060d870484b6290b846adcd8 Sample

modified 2026-10-16 12:10:09
SmokeLoader (Cyber Threat Alliance)

http://gebeus.ru/tmp/index.php URL

modified 2026-10-16 10:38:05
SmokeLoader (ThreatFox Abuse.ch)

cad72c52ac28cb87be1dc40de1cb805cd9c0cd153bf7669cb803f27f27a4bb21 Sample

modified 2026-10-16 10:12:38
SmokeLoader (Cyber Threat Alliance)

40b4da6835eb442f4851b054b1ae57bce4ae712c6f10be3e18ecbf40eaa28419 Sample

modified 2026-10-16 10:07:08
SmokeLoader (Cyber Threat Alliance)

480b9dfcd4634ffe45b13bca11160259affff2dadaeb3a6fb2671ddf5a15bfc9 Sample

modified 2026-10-16 08:58:38
SmokeLoader (Cyber Threat Alliance)

90233bc1c07e84fa9c9c703124aa20bd59895f54d54d8d22aae7f1a69a12f4f9 Sample

modified 2026-10-16 08:57:08
SmokeLoader (Cyber Threat Alliance)

1796ab50b5db2c996eed74f282812d9a7e2e2249ed314ac02954903ddf3c1775 Sample

modified 2026-10-16 08:56:37
SmokeLoader (Cyber Threat Alliance)

blogstat355.xyz Hostname

modified 2026-10-16 08:40:18
SystemBC (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

clothes.surf Hostname

modified 2026-10-16 08:39:56
SmokeLoader (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

blogmstat389.xyz Hostname

modified 2026-10-16 08:39:20
SmokeLoader (ThreatFox Abuse.ch)

nahbleiben.at Hostname

modified 2026-10-16 08:39:06
SmokeLoader (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

computerexcudesp.shop Hostname

modified 2026-10-16 08:37:53
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

coox.live Hostname

modified 2026-10-16 08:37:15
Smokeloader (Maltiverse Threat Observatory) · Remus (ThreatFox Abuse.ch)

c011794513f1869ca874177f43466d66b909317144939dae4d7b823faca5dd6b Sample

modified 2026-10-16 08:12:38
SmokeLoader (Cyber Threat Alliance)

jaffacakes118_888efdded7a8913d6bbcac262ea6b3e9c0c4f2e283d335043b54cf8509f7daca Sample

modified 2026-10-16 08:06:47
Smokeloader (Triage)

13fbdf6c4bfbdc068e77e7ce2f130daff998153d1054b772ebc4427055d0df78 Sample

modified 2026-10-16 07:55:37
SmokeLoader (Cyber Threat Alliance)

jaffacakes118_1101a23f0fbfa057622c64ff9433061d846fbde9e405b736112e161a8f39a971 Sample

modified 2026-10-16 07:40:52
Smokeloader (Triage)

a16b68f77231b54e98e9bbc44507eb4d8859463a2dcf01aab521eba6c8ba1b04 Sample

modified 2026-10-16 06:59:37
SmokeLoader (Cyber Threat Alliance)

polinamailserverip.ru Hostname

modified 2026-10-16 06:27:52
SmokeLoader (ThreatFox Abuse.ch) · Malicious behavior (Maltiverse Threat Observatory)

60a556799bde6752a5970151faa074893e2ac657320a48201d2d53c3784783ef Sample

modified 2026-10-16 06:19:39
SmokeLoader (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

3fca0133b84eb1afbd51df5cc9b1e6742d2e3416104f3605a70b0440058e5afe Sample

modified 2026-10-16 05:07:41
SmokeLoader (Cyber Threat Alliance)

utah-saints.com Hostname

modified 2026-10-16 04:41:26
SmokeLoader (ThreatFox Abuse.ch)

gromograd.ru Hostname

modified 2026-10-16 04:38:56
SmokeLoader (ThreatFox Abuse.ch)

2026-04-04_e0e62ed285d54f2f46a21b999d175e4b_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop Sample

modified 2026-10-16 04:34:43
Smokeloader (Triage)