7-16-2018: Gozi ISFB Botnet ID "1798" IT

MD5: e5c7b986b6fd3733504db3fd6d6faada

Botnet ID		['1798']
Encryption key	['10291029JSJUYNHG']
Server			['12']
Domains			['185.20.185.165', '185.161.211.214', '195.123.224.99', '195.123.209.207', '93.171.216.24', '93.171.216.81', '93.179.69.17', '93.171.216.104', '185.20.185.228', '195.123.209.104']
DGA Base URL    ['com', 'ru', 'org']


URI Path:

/images/

Replica/Webinject:

https://sitergenis.com/it/
https://guardnet.review/

VNC Module:

clickara.com/images/vnc32sk.rar
clickara.com/images/vnc64sk.rar