2019-04-29: Emotet Loader -> Gozi ISFB Loader Tor (DreamBot)

ht/ @James_inthe_box
Emotet:
md5: 9d80bffaafa1f3896555a4bd63bb73e8

GOZI ISFB TOR: (Possible DreamBot):

md5: 25a93a644b901224448baf90c9b8b6ae
url: ['http://aaxvkah7dudzoloq[.]onion', 'http://alfa-sentavra[.]at', 'http://miska-server[.]at', 'http://anti-doping[.]at']
dga_url: ['constitution.org/usdeclar.txt']
dga_see: ['0x4eb7d2ca']
dga_tld: ['com', 'ru', 'org']
tor_1: ['interruption.ru/key/t32.bin', 'file://%appdata%/system32.dll']
tor_2: ['interruption.ru/key/t64.bin','file://%appdata%/system64.dll']
ip_check: ['curlmyip.net']
id: ['Gu9foUnsY506KSJ1']

Inject Server:
https://classpana[.]host