7-9-2018: #Gozi #ISFB Botnet ID 2002

MD5: 3414c281d406652da549f182112ccc48

DGA Seed:
0x4636f0f5

Botnet ID		['2002']
Encryption key	['Gu9foUnsY506KSJ1']
32-bit DLL URLs	['providedatheyfromyouthe.club/key/x32.bin', 'file://%appdata%/system32.dll']
64-bit DLL URLs	['providedatheyfromyouthe.club/key/x64.bin', 'file://%appdata%/system64.dll']
IP Service		['curlmyip.net']
DGA CRC			['0x4636f0f5']
Domains			['otherwiselist.at']
DGA Base URL	['www.openssl.org/source/license.txt']
TOR Domains		['aaxvkah7dudzoloq.onion']

Domains:
['adverincludedaeric.club','softwaresouhud.club','copyrightproductused.club','causedtheprodsoftware.club','follmuststalicensefollap.club']

URI Path:

/images/