2018-12-14: ISFB v215 & v214 & v300

MD5 (2018-12-14.isfbv215.loader.unpacked.vk.exe) = 8a4303afcee39635be826d6bbac1e50c

Bot                     ['2.15']
Build                   ['165']
Botnet/Group ID         ['3154', '3155']
DGA TLDs                ['com', 'ru', 'org']
Server                  [’12’]
Encryption key          ['10291029JSJUYNHG']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['roevinguef.com', 'sfernacrif.com', 'abregeousn.com']
Path:                   ['/images/']

MD5 (2018-12-14.isfbv214.loader.unpacked.vk.exe) = a8c1709ca7becd32d79dd7fb2e219b40

Bot                     ['2.14']
Build                   ['056']
Botnet/Group ID         ['4000']
DGA TLDs                ['com', 'ru', 'org']
Server                  [’12’]
Encryption key          ['10291029JSJUYNHG']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['http://allooalel.club']
Path:                   ['/images/']

MD5 (2018-12-14.isfbv300.loader.unpacked.vk.exe) = 41fff120955f52a2f92c20280feca376

Bot                     ['3.00']
Build                   ['667']
Botnet/Group ID         ['40002']
DGA TLDs                ['com', 'ru', 'org']
Encryption key          ['ynL8iuZPneH9NUz5']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['https://brentleybag.com']

Payload Domains (ISFB v215):

tubpariang.com/KHZ/diuyz.php?l=skeb[1-14].tkn
usteouraph.com/KHZ/diuyz.php?l=lyfx[1-14].tkn
altwativar.com/KHZ/diuyz.php?l=skeb[1-14].tkn