Loader
SmokeLoader
aka Dofoil · Sharik · Smoke · Smoke Loader
The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware.
SmokeLoader, also known as Dofoil, Sharik, Smoke, Smoke Loader, is a Windows loader operated by SMOKY SPIDER and UAC-0006.
Background
SmokeLoader is a general-purpose backdoor whose feature set varies according to which modules are bundled into a particular build. It reaches victims through many different delivery methods and is widely tied to criminal operations. To mask its C2 traffic, the malware often issues requests to legitimate destinations like microsoft.com, bing.com, adobe.com, and others; the genuine download usually comes back as an HTTP 404 while still carrying data in the response body.
Source: Malpedia (Fraunhofer FKIE).