7-11-2018: #Gozi #ISFB Bot Version 2.14 Targeting IT

MD5: 694bfc302dfe1da71c1a5338a1864d43

Botnet ID       ['1911']
Bot version		['2.14']
Bot build 		['999']
Server id 		['12']
CRC hash		['67aab']
Encryption key  ['10291029JSJUYNHG']
Domains         ['foqiweuqwenasjdd.com', 'uhqweuansdjqwndq.com']
DGA Base URL    ['com', 'ru', 'org']

Domains:
['95.181.178.128','95.181.179.31','185.161.210.169','185.20.185.228','195.123.218.22', '195.123.209.104', '195.123.224.194', '93.171.216.104', '93.171.216.102']

URI Path:

/images/

Replica/Webinject:

https://sitergenis.com/it/

VNC Module:

clickara.com/images/vnc32sk.rar
clickara.com/images/vnc64sk.rar