2019/09/12 RIG EK -> Smokeloader -> MedusaHTTP & Crysis & mo

https://app.any.run/tasks/30b7210f-e377-462c-a320-c4f5e5fa5ceb

Main object- "rad1934D.tmp.exe"
	sha256	3b1273cc0c908fa82ca100d43092afcb8686d5f8f21b49e242ac3311eba07965
	sha1	9d9645b7dbb60deff73f0ccd79c263b00dee93aa
	md5	1092489c5164016551b98ed4c3a0a118
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\fthtujv	3b1273cc0c908fa82ca100d43092afcb8686d5f8f21b49e242ac3311eba07965
	sha256	C:\Users\admin\AppData\Local\Temp\F92E.tmp.exe	b4e24d83655f2633d82ff444a237b0d63452ad5c4d128e1b2b82466d42d9ea92
	sha256	C:\Users\admin\AppData\Local\Temp\15.tmp.exe	a891f13d3548a56767763e24e2ff34f7dc7c95276e919b7350af779c2aca54ea
	sha256	C:\Users\admin\AppData\Local\Temp\1728.tmp.exe	feb7ebb3a1bf6d1cdbb4e9a15438f860943f270094d8caf0a4dcb29c56a40340
	sha256	C:\Users\admin\AppData\Local\Temp\2B7C.tmp.exe	8660e7bf7ed1902c8e60cdc9fd2a1e57ecffe2841e4a7e1f2b8aa9aa0fa906a0
	sha256	C:\Users\admin\AppData\Local\Temp\D47F.tmp	3a98d10a2792713d8368920cb139323aae576bee3ca70f5ab23f91af4f2bb244
DNS requests
	domain	advertserv25.world
	domain	mailserv93fd.world
	domain	api.ipify.org
	domain	statexadver19tx.world
	domain	cdnshop78.world
	domain	tom.bit
Connections
	ip	89.41.173.142
	ip	5.9.26.115
	ip	2.19.192.25
	ip	5.101.181.35
	ip	193.23.244.244
	ip	176.119.29.14
	ip	91.213.233.60
	ip	31.184.196.232
	ip	185.80.222.158
	ip	50.19.218.16
	ip	86.59.21.38
	ip	204.13.164.118
HTTP/HTTPS requests
	url	http_//advertserv25.world/logstatx77/
	url	http_//mailserv93fd.world/sky/pred444rt.exe
	url	http_//mailserv93fd.world/tom.exe
	url	http_//mailserv93fd.world/fun222sd.exe
	url	http_//mailserv93fd.world/sky/dmx444sk.exe
	url	http_//cdnshop78.world/forums/members/api.jsp
	url	http_//statexadver19tx.world/api/check.get
	url	http_//185.80.222.158:443/tor/server/fp/49bc7301250f6d87bcd676dfc9af22048f96f599
	url	http_//193.23.244.244/tor/status-vote/current/consensus
	url	http_//185.80.222.158:443/tor/server/fp/30cce566790efe85209bc7a6bf96d77c892efd74
	url	http_//185.80.222.158:443/tor/server/fp/353e85d1d96494f471015863e01800ef60db2a90
	url	http_//185.80.222.158:443/tor/server/fp/99339f3e68bccc1391bf14c821d80766fe0c5956
	url	http_//204.13.164.118/tor/status-vote/current/consensus
	url	http_//86.59.21.38/tor/status-vote/current/consensus