SmokeLoader Malware Found in Open Directories Targeting Ukraine’s Auto & Banking Industries

Hunt researchers identified an open directory hosting SmokeLoader samples alongside lure documents targeting Ukraine's automotive and banking sectors. A second related directory contained the same malware but with different lures, suggesting a broader campaign. The misconfigured servers exposed the staging and distribution methods used in this campaign, offering direct insight into the threat actor's operational tactics.

SmokeLoader remains a tool for cybercriminals and suspected Russian threat actors, often used for initial access before delivering secondary payloads such as credential stealers and remote access trojans (RATs). Recent reports highlight its continued deployment in operations against Ukrainian organizations, reinforcing its role in both cybercrime and espionage-driven attacks.

The following sections examine the findings, analyze the malware and lure files, and break down the malicious infrastructure supporting this activity.

SmokeLoader: A Brief Overview

First identified in 2011, SmokeLoader has evolved into a versatile and persistent threat in the cyber landscape. Originally designed as a malware loader, it remains a preferred tool for adversaries due to its lightweight nature and ability to execute additional payloads on compromised systems. Its modular framework allows operators to tailor functionality, making it effective for both large-scale operations and more targeted intrusions.

While SmokeLoader has long been associated with financially motivated campaigns, its presence in operations against Ukrainian organizations highlights its continued adaptability. Its obfuscation techniques and ability to deliver a variety of secondary malware ensure it remains a reliable choice for threat actors looking to maintain access, evade detection, and distribute additional payloads as needed.

Open Directory Findings: What We Discovered

Browsing Hunt's AttackCapture™ listing for recently scanned open directories, researchers identified an exposed server at 2.59.163[.]172, hosted on the Global Connectivity Solutions LLP network in Poland. The directory contained multiple Windows executables and PDF files labeled "invoce," a likely misspelling of "invoice." The file names suggest the actor leveraged financial-themed lures, a common tactic in phishing campaigns.

As shown in the figure below, Hunt automatically detected and tagged several of these files as SmokeLoader samples. A subfolder named "ukraine" stands out, suggesting a deliberate focus on Ukrainian targets. The directory's structure and contents indicate it was set up to deliver malware rather than being an incidental collection of files.

In AttackCapture™, pivoting on files is as simple as clicking on the three dots next to the file and selecting "Search by SHA256." In this case, the number next to the option was 2, indicating the same executable file was hosted in another directory.

That second server, located at 88.151.192[.]50 and hosted on the Global Connectivity Solutions LLP network in Ukraine, contained the same three Windows files--svc.exe, svc1.exe, and svc2.exe--indicating that both servers were likely part of the same staging infrastructure.

The above screenshot shows the directory structure closely mirrors our first server, including the "ukraine" subfolder. However, there are two key differences:

• The PDF files are named invoce.pdf and invoce2.pdf.

• A newly detected file, putty.exe, appeared alongside the SmokeLoader samples. While unrelated to the financial lures, its presence suggests an attempt to deceive users seeking to download or execute the legitimate SSH client, a common tactic for malware delivery.

A single domain resolves to this IP, www[.]connecticutproperty[.]ru, which will appear again later in this post.

PDF Lures

Among the files found on the initial server, a single PDF, "invoce415.pdf," was used in conjunction with the malicious files. The document posing as an invoice from Ілта (Ilta), an official importer of Peugeot vehicles in Ukraine since 1992. The company provides sales, service, and leasing options for Peugeot, Citroën, and DS vehicles, making it a plausible lure for targeting individuals or businesses in the automotive sector.

While fake invoices are a common phishing tactic, referencing a well-known Ukrainian business adds credibility to the lure, increasing the chances that a recipient will engage with it. This document was likely distributed as part of a phishing operation, where the attacker urged the recipient to download and open the file, leading to the execution of SmokeLoader.

Within the second directory, the first of the two PDFs, invoce.pdf appears to be an account statement from Raiffeisen Bank, a major commercial bank in Ukraine. Raiffeisen was designated a systemically important bank by the National Bank of Ukraine in 2024.

The second file, invoce2.pdf, is another financial statement dated at the end of July 2024. The document purports to be from __Sense Bank, one of Ukraine's largest financial institutions. Previously known as Alfa-Bank before 2022, Sense Bank remains a recognizable name in the country's financial sector, making it an effective lure for phishing attempts.

Malware Analysis

Recent reporting from AhnLab and Trend Micro detailed SmokeLoader campaigns leveraging 7-Zip archives for delivery. While that specific technique was not present in the open directories we analyzed, there were noticeable overlaps-lure documents targeting Ukrainian organizations, domains following similar naming patterns, and a known SmokeLoader command-and-control server.

Once executed, SmokeLoader injects into explorer.exe and creates a duplicate of itself in the AppData directory under the name "hbasjiu" to evade detection. It then establishes communication with the following command-and-control servers via HTTP POST requests:

• 94.156.177[.]72:80

• 2.59.163[.]71:80

Notably, network traffic analysis revealed that each request contained a dynamically changing Referer header, with values generated from domain generation algorithm (DGA) domains.

The malware's configuration also contained hardcoded domains, though no additional payloads were observed during analysis:

• http://constractionscity1991[.]lat

• http://restructurisationservice[.]ru

• http://connecticutproperty[.]ru

Final Note

Hunt users can explore additional open directories hosting SmokeLoader and multiple other malware families in AttackCapture™ by searching for the tag.

Conclusion

Our findings highlight how open directories continue to expose malware distribution operations, providing direct visibility into threat actor infrastructure, targeting, and execution methods. The uncovered servers contained SmokeLoader samples staged alongside financial-themed lure documents impersonating Ukrainian banks and businesses---tactics consistent with previously observed campaigns.

By tracking open directories, defenders can gain early insight into adversary behaviors, helping to identify active malware campaigns before deployment at scale. Researchers can use AttackCapture™ to search for SmokeLoader and other malware families, uncovering additional staging servers and refining detection strategies.

Network Observables and Indicators of Compromise (IOCs)

Host Observables and Indicators of Compromise