Smoke Loader Drops Whiffy Recon Wi-Fi Scanning and Geolocation Malware
Whiffy Recon works by checking for the WLAN AutoConfig service (WLANSVC) on the infected system and terminating itself if the service name doesn’t exist. Persistence is achieved by means of a shortcut that’s added to the Windows Startup folder.