2019/09/18 RIG EK -> Smokeloader -> Other Malware

2019-09-18
#Malvertising -> #RIGEK -> #Smokeloader -> #Crysis (#dharma) #Ransomware & #Kpot

[Example Payload]
https://app.any.run/tasks/2d5a8b13-c486-4694-8f22-19003a01f445

[Detail]
Main object- "radEE381.tmp.exe"
	sha256	5817e04d8c56a3d83d602de33e52aa8bd792e01818c917b6c371c41d51abc0f6
	sha1	6009e6039cfd7dff8baa0ddff24b69a5e3dc35c2
	md5	72424e522fac4dac9645b1f4b551d6d0
Dropped executable file
	sha256	C:\Users\admin\AppData\Roaming\fthtujv	5817e04d8c56a3d83d602de33e52aa8bd792e01818c917b6c371c41d51abc0f6
	sha256	C:\Users\admin\AppData\Local\Temp\BA38.tmp.exe	e07269786ee9099974a614f324b3f65058ad5c594bea1e4156a9bcd00f6cf940
	sha256	C:\Users\admin\AppData\Local\Temp\7B66.tmp.exe	79e5cef8f4722b6e99e469ea9e66922e0f2df65aa77adce5c6ec438366b64cb8
	sha256	C:\Users\admin\AppData\Local\Temp\D47F.tmp	3a98d10a2792713d8368920cb139323aae576bee3ca70f5ab23f91af4f2bb244
DNS requests
	domain	advertmarin48.world
	domain	mailserv43fd.world
	domain	advertstat19.com
Connections
	ip	5.9.26.115
	ip	23.211.117.33
	ip	213.252.245.227
	ip	213.252.244.29
HTTP/HTTPS requests
	url	http://advertmarin48.world/serverlogs29/
	url	http://mailserv43fd.world/sky/dmx999pkz.exe
	url	http://mailserv43fd.world/sky/crot333mtx.exe
	url	http://advertstat19.com/cq2fKWVooVNMYqNW/conf.php