SMOKEDHAM is a fileless Windows backdoor that lives entirely in your computer's memory, leaving almost no trace on disk. First documented by Mandiant, this sophisticated malware arrives through a PowerShell script that carries encrypted C# source code—meaning it compiles and executes directly in RAM without ever writing a traditional executable file to your hard drive. This memory-only approach makes SMOKEDHAM particularly difficult for conventional antivirus software to detect, and it's typically deployed as part of targeted intrusions where attackers have already gained a foothold in an organization or network.
Threat Profile
| Threat Name | SMOKEDHAM |
|---|---|
| Threat Type | Fileless backdoor / Remote access trojan (RAT) |
| Platform | Windows (all versions supporting .NET Framework) |
| File Type | PowerShell script wrapper containing encrypted C# source code |
| Primary Persistence | Memory-resident; may use registry Run keys or scheduled tasks for dropper persistence |
| First Documented | 2026 (Mandiant reporting) |
| Distribution Method | Typically secondary payload in targeted intrusions; deployed post-compromise |
| Payload Delivery | PowerShell script dynamically compiles .NET assembly in memory |
| Detection Difficulty | High—no disk-based executable, minimal forensic artifacts |
| Known Aliases | SMOKEDHAM (primary designation; no widely-used alternates) |
| Targeted Sectors | Varies; consistent with advanced persistent threat (APT) operations |
| Removal Complexity | High—requires memory forensics and comprehensive system audit |
How It Spreads
SMOKEDHAM is not a mass-distribution threat like ransomware or banking trojans. Instead, it functions as a second-stage payload deployed by attackers who have already compromised a network through other means—typically phishing, exploited vulnerabilities, or stolen credentials. Once initial access is established, the attackers use their foothold to execute a PowerShell script that delivers SMOKEDHAM, allowing them to maintain stealthy, persistent access to high-value targets.
The fileless nature of SMOKEDHAM makes traditional infection vectors less relevant. You won't find this malware attached to spam emails or bundled with pirated software. It's delivered through administrative tools and legitimate Windows utilities after an attacker has already gained elevated privileges. This targeted deployment model means most home users and small businesses are unlikely to encounter SMOKEDHAM unless they're specifically chosen as targets—but that doesn't mean you're immune if your business handles sensitive data or intellectual property.
Common deployment scenarios include:
- Lateral movement after network breach: Attackers compromise one machine via phishing or exploit, then use that access to deploy SMOKEDHAM on additional systems across the network
- Post-exploitation frameworks: Tools like Cobalt Strike or Metasploit can execute the PowerShell dropper remotely once a session is established
- Compromised administrative credentials: Stolen or weak admin passwords allow attackers to run PowerShell scripts with elevated privileges
- Supply chain attacks: In rare cases, malicious code may be injected into software update mechanisms or third-party vendor tools
- Living-off-the-land techniques: Attackers abuse legitimate Windows management tools (WMI, PsExec, remote PowerShell) to execute the dropper script without raising immediate alarms
What It Does On Your Machine
Once the PowerShell dropper executes, SMOKEDHAM decrypts its embedded C# source code and uses PowerShell's built-in Add-Type cmdlet to compile a .NET assembly directly in memory. This assembly defines the backdoor functionality and establishes command-and-control communication. Because the compiled code never touches the disk, traditional antivirus scans that examine files will miss it entirely. The malware exists only as a running process in RAM, making detection dependent on behavioral analysis or memory forensics rather than signature-based scanning.
SMOKEDHAM functions as a backdoor, meaning it creates a hidden channel for remote attackers to issue commands and extract data. The specific capabilities vary depending on how the attackers have configured this particular instance, but typical backdoor functionality includes executing arbitrary commands, downloading additional payloads, exfiltrating files, capturing screenshots, and monitoring user activity. Since the code is compiled at runtime, attackers can easily modify the embedded source to add or remove features for each deployment.
The PowerShell dropper often establishes persistence by creating scheduled tasks or registry Run keys that re-execute the script after reboot. However, the actual backdoor code remains memory-resident between executions. When examining an infected system, you might observe the following artifacts (observed in enterprise incident response scenarios):
Because SMOKEDHAM is designed for stealth, you're unlikely to notice obvious symptoms like pop-ups or system slowdowns. The backdoor typically consumes minimal resources and operates during normal business hours to blend in with legitimate network traffic. You might observe unexplained PowerShell processes in Task Manager, unusual network connections to unfamiliar domains, or antivirus alerts about suspicious PowerShell activity—but these signs require active monitoring to catch. Many victims don't realize they're compromised until a security audit or breach notification from a third party reveals the intrusion.
Manual Removal — Step by Step
Disconnect from all networks immediately
Unplug the Ethernet cable and disable Wi-Fi. SMOKEDHAM's primary value to attackers is real-time remote access—cutting network connectivity stops command-and-control communication and prevents further data exfiltration while you work on removal.
Boot into Safe Mode with Networking
Restart the computer and press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select Safe Mode with Networking. This loads Windows with minimal drivers and services, which can prevent the dropper script from executing automatically if it relies on standard startup mechanisms.
Terminate suspicious PowerShell processes
Open Task Manager (Ctrl+Shift+Esc) and look for powershell.exe or pwsh.exe processes, especially those running with unusual parent processes or command-line arguments. Right-click and select "End Process Tree." Note that legitimate PowerShell processes do exist, so focus on instances with hidden windows, encoded commands, or unexpected parent processes like schtasks.exe or wmiprvse.exe.
Check and remove persistence mechanisms
Press Win+R, type regedit, and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries with PowerShell commands (especially base64-encoded ones). Delete any suspicious entries. Then open Task Scheduler (search "Task Scheduler" in Start menu) and review all tasks, especially those in the root folder or those created recently. Delete any that reference PowerShell scripts or encoded commands you don't recognize.
Search for PowerShell script files
Use Windows Search or File Explorer to look for .ps1 files in common locations like C:\Users\[YourUsername]\AppData\Local\Temp\, C:\Users\[YourUsername]\Documents\, and C:\ProgramData\. Review the contents of any unfamiliar scripts (open with Notepad) and delete those containing encoded commands, obfuscated code, or references to Add-Type cmdlets that compile C# code.
Clear PowerShell history and logs
Open PowerShell as Administrator and run Clear-History to remove command history from the current session. Then navigate to C:\Users\[YourUsername]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ and delete ConsoleHost_history.txt. This prevents the malware dropper from being re-executed via recalled commands, though it also removes forensic evidence—so only do this after documenting what you've found.
Run a full system scan with updated antivirus
Update your antivirus definitions and perform a complete system scan. While SMOKEDHAM's memory-resident nature makes detection difficult, good endpoint protection may flag the PowerShell dropper script or associated persistence mechanisms. Consider using multiple scanners (Windows Defender, Malwarebytes, etc.) for broader coverage.
Review user accounts and change all passwords
Open Computer Management (Win+X → Computer Management → Local Users and Groups) and verify that no unauthorized accounts exist. Since SMOKEDHAM is typically part of a larger breach, assume all credentials on the compromised machine are compromised. Change passwords for all accounts—especially administrator accounts—using a different, known-clean device. Enable multi-factor authentication wherever possible.
Monitor system behavior after reboot
Restart the computer normally and watch for signs of re-infection: unexpected PowerShell windows, unusual network activity, or registry/scheduled task changes. Use Resource Monitor (resmon.exe) to observe network connections and Process Explorer (from Microsoft Sysinternals) to examine process details. If suspicious activity resumes, the infection may be deeper than manual removal can address.
Consider professional forensic analysis
Given SMOKEDHAM's fileless design and targeted deployment, manual removal may not fully eliminate the threat—especially if other malware is present or if the initial compromise vector remains unpatched. If this system contained sensitive business data, intellectual property, or customer information, professional incident response and forensic imaging are strongly recommended to determine the full scope of compromise.
Prevention
- Restrict PowerShell execution policies and script access. On most home and small-business systems, PowerShell scripts rarely need to run with unrestricted access. Use Group Policy or PowerShell cmdlets to set execution policy to "RemoteSigned" or "AllSigned," requiring scripts to be digitally signed. For even tighter control, enable PowerShell Constrained Language Mode to limit the cmdlets available to untrusted scripts.
- Enable PowerShell script block logging and transcription. Windows 10 and later can log the content of all PowerShell commands and scripts executed on the system. Enable these features through Group Policy (Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell) to create an audit trail that can reveal suspicious activity even if the malware itself leaves no disk artifacts.
- Deploy endpoint detection and response (EDR) or advanced antivirus. Traditional signature-based antivirus won't catch SMOKEDHAM, but behavioral analysis tools that monitor process creation, memory injection, and network connections can flag the dropper's execution or the backdoor's command-and-control traffic. Solutions like Windows Defender for Endpoint, CrowdStrike, or SentinelOne are designed to detect fileless threats.
- Implement application whitelisting. Tools like Windows AppLocker or third-party application control solutions prevent unauthorized executables and scripts from running. By allowing only approved applications and requiring administrator approval for new software, you create a barrier against attackers who rely on executing malicious PowerShell code.
- Enforce least-privilege access and separate admin accounts. Most users don't need administrative rights for daily tasks. Create standard user accounts for routine work and reserve administrator accounts for installation and configuration tasks only. This limits an attacker's ability to deploy SMOKEDHAM, which typically requires elevated privileges to establish persistence.
- Keep systems and software fully patched. While SMOKEDHAM itself isn't exploit-based, attackers typically gain initial access through vulnerabilities in operating systems, browsers, or applications. Enable automatic updates for Windows and all software, and prioritize security patches for internet-facing applications and remote access tools.
- Monitor and restrict outbound network connections. SMOKEDHAM needs to communicate with attacker-controlled infrastructure. Deploy a firewall that logs outbound connections and use DNS filtering to block known malicious domains. For business networks, consider implementing egress filtering that allows only necessary protocols and destinations.
- Conduct regular security awareness training. Since SMOKEDHAM arrives after an initial compromise, preventing that first foothold is critical. Train employees (and family members, for home networks) to recognize phishing emails, avoid clicking suspicious links, and report unusual computer behavior immediately.
Bring It In
SMOKEDHAM represents a class of malware that's designed to evade traditional defenses and stay hidden for months or years. Because it lives entirely in memory and uses legitimate Windows tools to operate, detecting and removing it requires specialized knowledge and forensic tools that go beyond what most users have at their disposal. If you suspect your system has been compromised—whether through unusual network activity, antivirus alerts about PowerShell, or a tip from your IT department—don't try to power through this alone.
Computer Repair Roswell offers comprehensive malware analysis and removal services right here in Roswell, Georgia. We use professional-grade forensic tools to examine memory, analyze running processes, and identify persistence mechanisms that typical scans miss. Call us at (770) 856-1577 or stop by our shop at 1735 Woodstock Road, Suite 201. Whether you're dealing with a confirmed SMOKEDHAM infection or just want peace of mind that your system is clean, we'll give you straight answers and effective solutions—no scare tactics, no upselling, just honest technical expertise you can trust.