2019/09/15 RIG EK -> Smokeloader -> Crysis & Predator & Quas

2019/09/15 RIG EK -> Smokeloader -> Crysis & Predator & Quasar

https://app.any.run/tasks/a80110b0-902e-4da6-a05e-bd5d9aef82a8

Main object- "bbkbw6ut.exe"
	sha256	a8c762168fd6db06cdc7410aaf553ac930d9466c119ae366026aafb912b0e0ca
	sha1	3c1b650b87a9fc74c300f6438f6c7cbd69f93910
	md5	2f2c2135f0daca933598d406324acb9e
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\fthtujv	a8c762168fd6db06cdc7410aaf553ac930d9466c119ae366026aafb912b0e0ca
	sha256	C:\Users\admin\AppData\Local\Temp\6CB.tmp.exe	12a607dff06d89c142790c0130801303511793750d0f18c084b0b800c89e36d5
	sha256	C:\Users\admin\AppData\Local\Temp\1F74.tmp.exe	543c0f2d14c4fc5b4599889d5dcb547c6adebcbfaef27b8e63b30ff9cc9995b5
	sha256	C:\Users\admin\AppData\Local\Temp\4741.tmp.exe	8dbb1b972bc40e15daadc42428a5a19963c7d9b64d41e0775b2f1bc5aa505332
	sha256	C:\Users\admin\AppData\Local\Temp\D47F.tmp	3a98d10a2792713d8368920cb139323aae576bee3ca70f5ab23f91af4f2bb244
DNS requests
	domain	advertserv25.world
	domain	advexmail23mn.world
	domain	mailadvert5917dx.world
Connections
	ip	5.9.26.115
	ip	185.25.50.148
	ip	119.207.64.137
	ip	185.25.50.163
	ip	195.201.161.25
HTTP/HTTPS requests
	url	http://advertserv25.world/logstatx77/
	url	http://mailadvert5917dx.world/sky/dmx27km.exe
	url	http://mailadvert5917dx.world/mp444tx.exe
	url	http://195.201.161.25:2012/websocket
	url	http://mailadvert5917dx.world/sky/pred37sd.exe
	url	http://advexmail23mn.world/api/check.get