-- BEACON
https://pilodirsob.com/images/AUIWHXVkKlubGO/A1O_2BK4DyfenPyCqKnHq/ts18nhz9IAaYhX25/aIKdXtatoJv3Yjv/l3E_2F7pYg_2FV91ox/WrEs8aPMc/LNoTvGHA617XE4gMWNng/hjlTFj689mMtKaZ8LgN/zEKoxSe8BlTCJ0WqxaZVFV/_2BXKlWj_2FlX/Bv3zg8RA/EU_2BPBkyNAs_2FVSq8oQ2Q/fJTSvIaGIg/ZtB77g_2Bu_2BhViq/Qu5AWRp.gif


[i] Extension .gif: Ask for a task
[i] Key: CBA17F7E892431A1
[i] Domain: pilodirsob.com
[i] Decrypted path: onawjktiw=lblrwtlpr&soft=1&version=300054&user=34fd5cf4b26c87c4b317839e8603345f&server=12&id=1000&crc=18c8bc80&guid=c705cb602f5d969f6e9a9e804f76c34b
[+] This beaconing looks like ISFB v3
[+] GUID: c705cb602f5d969f6e9a9e804f76c34b
[+] Soft: 1
[+] Bot version: 3.00.05.4
[+] CnC server ID: 12
[+] Bot ID: 34fd5cf4b26c87c4b317839e8603345f