2018-11-21: Gozi ISFB v217

MD5 (2018-11-21.isfbv217.loader.decoded.vk.exe) = 4486f26bde40f0fd47a0303abec61978
MD5 (2018-11-21.isfbv217.client.decoded.vk.dll) = fb6e8deeb32c23ffa3d9d7aed4446c11


Bot                     ['2.17']
Build                   ['39']
Botnet/Group ID         ['3120', '3121']
DGA TLDs                ['com', 'ru', 'org']
Server                  [’12’]
Encryption key          ['10291029JSJUYNHG']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['mezendracr.com', 'objecopoly.com', 'eastiggeno.com']
Path:                   ['/images/']