10-24-2018: Gozi ISFB

MD5 (10-24-2018.isfb.client.unpacked.exe.vk.dll) = 10887dbdf66fe858fbbbc6254818f76b
MD5 (10-24-2018.isfb.loader.unpacked.exe.vk.exe) = 372116122ca64db56fc02317d5ea4de3

Bot                     ['2.17']
Build                   ['38']
Botnet/Group ID         ['1000]
DGA TLDs                ['com', 'ru', 'org']
Server                  ['110']
Encryption key          ['K2u7G0lE4u1VoS0V']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['doc.rendes.at/wpapi', 'torafy.cn/wpapi', 'io.ledalco.at/wpapi', 'int.gardeon.at/wpapi', 'api.rendes.at/wpapi', 'rest.relonter.at/wpapi', 'yraco.cn/wpapi', 'apt.zorip.at/wpapi', 'vi.relonter.at/wpapi', 'pr.jingletrip.at/wpapi', 'gl.filmbounce.at/wpapi', 'in.ledalco.at/wpapi', 'ht.letosos.at/wpapi', 'harent.cn/wpapi', 'h2.letosos.at/wpapi']
Path:                   ['/images/']