2019/09/12 RIG EK -> Smokeloader -> MedusaHTTP

https://app.any.run/tasks/eaf4b92a-d898-49cf-9f6b-65721ab88001

Main object- "rad1934D.tmp.exe"
	sha256	3b1273cc0c908fa82ca100d43092afcb8686d5f8f21b49e242ac3311eba07965
	sha1	9d9645b7dbb60deff73f0ccd79c263b00dee93aa
	md5	1092489c5164016551b98ed4c3a0a118
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\fthtujv	3b1273cc0c908fa82ca100d43092afcb8686d5f8f21b49e242ac3311eba07965
	sha256	C:\Users\admin\AppData\Local\Temp\E652.tmp.exe	fe6ed0bc9560e030656b1d707958803f810901a433a23bbaabd897604882ba23
	sha256	C:\Users\admin\AppData\Local\Temp\D47F.tmp	3a98d10a2792713d8368920cb139323aae576bee3ca70f5ab23f91af4f2bb244
DNS requests
	domain	advertserv25.world
	domain	cdnshop78.world
	domain	www.banksolutions.it
	domain	mailserv93fd.world
Connections
	ip	5.9.26.115
	ip	184.150.154.51
	ip	54.36.166.56
	ip	176.119.29.14
	ip	184.150.154.49
	ip	192.35.177.64
	ip	5.101.181.35
HTTP/HTTPS requests
	url	http_//advertserv25.world/logstatx77/
	url	http_//mailserv93fd.world/fun333.exe
	url	http_//cdnshop78.world/forums/members/api.jsp