2018-11-20: Gozi ISFB v3

MD5 (2018-11-20.isfbv3.loader.decoded.vk.exe) = cb77394b737fa8163c4ba0ac4c499859


Bot                     ['3.00']
Build                   ['667']
Botnet/Group ID         ['201811191']
DGA TLDs                ['com', 'ru', 'org']
Encryption key          ['Rtaahlhckic3gMUu']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['https://divinemarketplace.com']