2019/09/21 RIG EK -> Smokeloader -> Other Malware

#Malvertising -> #RIGEK -> #Smokeloader

#Crysis & #Kpot & #DarkRat

[Example Payload]
https://app.any.run/tasks/47c33e63-9d75-4869-8b9a-caead9759135
https://app.any.run/tasks/3241402e-8a4e-4974-9e19-68a484e66903
====================================================================
Main object- "rad17AB0.tmp.exe"
	sha256	a0a1f4e33a3c91564bc6beaa5f47469ee4d7267a1b7aff4e11852153223f4c79
	sha1	62b6171812cf5bc4a67d38ecddf0a3eb75bbdcad
	md5	f77225b0097e989c0da690eb6bf79095
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\fthtujv	a0a1f4e33a3c91564bc6beaa5f47469ee4d7267a1b7aff4e11852153223f4c79
	sha256	C:\Users\admin\AppData\Local\Temp\F518.tmp.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1
	sha256	C:\Users\admin\AppData\Local\Temp\F901.tmp.exe	772c0bbaf5482f408fd50678dbdae5bf9ee85fd9c4327327a20b664803d20da6
	sha256	C:\Users\admin\AppData\Local\Temp\FFF7.tmp.exe	503e352c0212844f71b57d600edc710c78a31d031f5d2101a07f500efd12c61e
	sha256	C:\Users\admin\AppData\Local\Temp\D47F.tmp	3a98d10a2792713d8368920cb139323aae576bee3ca70f5ab23f91af4f2bb244
DNS requests
	domain	advertmarin48.world
	domain	www.advertmarin48.world
	domain	mailsmall78.club
	domain	mailserv964k.world
	domain	advertstat233.world
	domain	pastebin.com
Connections
	ip	198.54.117.216
	ip	192.64.119.19
	ip	185.25.50.147
	ip	5.9.26.115
	ip	213.252.247.115
	ip	104.22.3.84
HTTP/HTTPS requests
	url	http://advertmarin48.world/serverlogs29/
	url	http://www.advertmarin48.world/serverlogs29/?from=@
	url	http://mailsmall78.club/serverlogs29/
	url	http://mailserv964k.world/sky/dmx737tx.exe
	url	http://mailserv964k.world/sky/crot999px.exe
	url	http://advertstat233.world/4rTpPY1f3zP4LAUq/conf.php
	url	http://mailserv964k.world/spread.exe
	url	http://pastebin.com/raw/dNqyCpKw
====================================================================
Main object- "spread.exe"
	sha256	503e352c0212844f71b57d600edc710c78a31d031f5d2101a07f500efd12c61e
	sha1	d441fd9ef841e5befa0584ac2f51e4c7090688ab
	md5	3c91eb49b0677e64ff7e9058b38782ce
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\Microsoft\Windows\jrQDjpZPtB.exe	503e352c0212844f71b57d600edc710c78a31d031f5d2101a07f500efd12c61e
DNS requests
	domain	pastebin.com
Connections
	ip	104.22.3.84
	ip	104.223.20.200
HTTP/HTTPS requests
	url	http://pastebin.com/raw/dNqyCpKw
	url	http://104.223.20.200/request