Malware in this family (which is also known as Smoke loader) is distributed by criminals with the help of the Trojan.Win32.Cutwail spam bot. Smoke loader is notable for its modular architecture, which enables the malware to gain additional features. Malware is distributed with help of Trojan-Ransom.Win 32.Cryptodef, or Trojan-Win3232.Cryptoodef. Smoke.Mokes family downloads other malware (such as Trojan-ransom.Cryptowall). Smoke loader can also be used to steal user passwords.”]
Source: https://threats.kaspersky.com/en/threat/Backdoor.Win32.Mokes/