9-28-2018: #Gozi #ISFB #Banker

Loader Original (MD5): be44f8a1c41024bf7e23d08fa068a337
Loader Unpacked (MD5): 4270040795e53dea814f2944d4d118a9
Client Unpacked (MD5): 4a6dbf55608e38c07015f5f03736194f

Bot                     ['2.17']
Build					['30']
Botnet ID               ['1000']
DGA TLDs                ['com', 'ru', 'org']
Server                  ['150']
Encryption key          ['F1cl1tAcbPsStUtM']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains					['doom.matr.at/rpc
						tri.umpalok.at/rpc
						tt.zicino.at/rpc
						fr.aporen.at/rpc
						app.nytronex.at/rpc
						ops.twidix.at/rpc
						io.upcu100.at/rpc
						m.umpalok.at/rpc
						sq.dreemkol.at/rpc
						a1.umpalok.at/rpc
						api.leproeg.at/rpc
						qqq.matr.at/rpc
						cd.ioptool.at/rpc
						chat.freemon.at/rpc
						mahono.cn/rpc
						win.zicino.at/rpc]