2019/09/17 RIG EK -> Smokeloader -> Other Malware

#Malvertising -> #RIGEK -> #Smokeloader

#Crysis (#dharma)  & #Vidar & #Predator & #kpot

[Example Payload]
https://app.any.run/tasks/8ab44e97-219f-4a44-a0a3-6c49b78fa6a4/
================================================================
Main object- "radD314E.tmp.exe"
	sha256	6c69ebcf9538467c1fd0b537a19ea47e7146ed801a53053c1353c83679a4159b
	sha1	77542ba98485882949fa421cb18aaf83b9e4c317
	md5	ab6a7544a697345151b8ccc0d60eecdb
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\fthtujv	6c69ebcf9538467c1fd0b537a19ea47e7146ed801a53053c1353c83679a4159b
	sha256	C:\Users\admin\AppData\Local\Temp\161D.tmp.exe	a3928623078f6667dc35f8346c497d1ee84ca8b58fd29cafa78174246d78f0ca
	sha256	C:\Users\admin\AppData\Local\Temp\1C86.tmp.exe	055244546364fd9dd857a2ba0ca2d1af856be37cb0160c6652300b1cbc6d0065
	sha256	C:\Users\admin\AppData\Local\Temp\2002.tmp.exe	77d670d768b4ed9d79f3de2cf7e099b760ce977b93c268587a8673dc80fe70a9
	sha256	C:\Users\admin\AppData\Local\Temp\23EB.tmp.exe	990cd15ae1518a5e68b47f5f717607de96bd79bb316bd24da9a5ba7772f25bd7
	sha256	C:\Users\admin\AppData\Local\Temp\2BBC.tmp.exe	c47eb1dafce229b1c9f143b9fbace813a3df62231f296f0cca6bfa913f5ac837
	sha256	C:\Users\admin\AppData\Local\Temp\2F57.tmp.exe	41e4ca6de30cc234d6ae05f3887e7a91a01c72ccb7d56d327f5bd8ea4f45e1cd
	sha256	C:\Users\admin\AppData\Local\Temp\D47F.tmp	3a98d10a2792713d8368920cb139323aae576bee3ca70f5ab23f91af4f2bb244
	sha256	C:\ProgramData\freebl3.dll	a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2U1WPAC\mozglue[1].dll	3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\msvcp140[1].dll	334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\nss3[1].dll	e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
	sha256	C:\ProgramData\softokn3.dll	43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\vcruntime140[1].dll	c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\client[1].exe	adecb2e76d737e6c598bd0204c698439d8b03d4951acb86bf57903f6d4afdeef
	sha256	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.id-7CD9E0E6.[3442516480@qq.com].pdf	90c570a2e35bdec68204e16c497749b409d83fbae53d8d4c067c0cf4f2dbfeb9
DNS requests
	domain	advertserv25.world
	domain	vidvpn.cc
	domain	www.advertserv25.world
	domain	mailadvert82dx.world
	domain	mailstatm74.club
	domain	advertstat19.com
	domain	anjalihome.org
	domain	ip-api.com
	domain	sdstat597tp.world
	domain	kutahya.hayvansagligi.com
Connections
	ip	198.54.117.218
	ip	162.255.119.221
	ip	5.9.26.115
	ip	185.25.51.155
	ip	178.157.82.166
	ip	104.27.157.207
	ip	213.252.245.227
	ip	185.194.141.58
	ip	213.252.245.139
	ip	45.93.245.10
HTTP/HTTPS requests
	url	http://www.advertserv25.world/logstatx77/?from=@
	url	http://advertserv25.world/logstatx77/
	url	http://mailstatm74.club/logstatx77/
	url	http://mailadvert82dx.world/sky/crot777mx.exe
	url	http://mailadvert82dx.world/del/del777pmx.exe
	url	http://anjalihome.org/72
	url	http://mailadvert82dx.world/sky/dmx22pms.exe
	url	http://anjalihome.org/freebl3.dll
	url	http://mailadvert82dx.world/sky/pred888amx.exe
	url	http://mailadvert82dx.world/fun111lm.exe
	url	http://anjalihome.org/vcruntime140.dll
	url	http://anjalihome.org/nss3.dll
	url	http://anjalihome.org/msvcp140.dll
	url	http://anjalihome.org/mozglue.dll
	url	http://anjalihome.org/softokn3.dll
	url	http://anjalihome.org/
	url	http://advertstat19.com/cq2fKWVooVNMYqNW/conf.php
	url	http://kutahya.hayvansagligi.com/wp-content/uploads/client.exe
	url	http://ip-api.com/line/
	url	http://sdstat597tp.world/api/check.get
	url	http://sdstat597tp.world/api/gate.get?p1=2&p2=15&p3=0&p4=0&p5=0&p6=0&p7=0&p8=0&p9=0