10-1-2018: Gozi ISFB Botnet "1000"

Packed Loader MD5: 7e17f0f35d50f49407841372f24fbd38

Bot                     ['2.17']
Build                   ['30']
Botnet ID               ['1000']
DGA TLDs                ['com', 'ru', 'org']
Server                  ['110']
Encryption key          ['K2u7G0lE4u1VoS0V']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['doc.rendes.at/wpapi
						torafy.cn/wpapi
						io.ledalco.at/wpapi
						app.strikeapple.at/wpapi
						api.rendes.at/wpapi
						rest.relonter.at/wpapi
						yraco.cn/wpapi
						psi.patrons.at/wpapi
						vi.relonter.at/wpapi
						admin.doriton.at/wpapi
						mp.musicdance.at/wpapi
						in.ledalco.at/wpapi
						ht.letosos.at/wpapi
						harent.cn/wpapi
						]