8-20-2018: Gozi ISFB Botnet ID "1000"

MD5: c7a0b7875f975c172884f6c29ce85e5f
https://app.any.run/tasks/aebb579e-276a-48cc-bf4d-fb36281f3092

Config Fail Timeout		[u'1200']
Send Timeout			[u'240']
Knocker Timeout			[u'300']
DGA Season				[u'10']
Botnet ID				[u'1000']
DGA TLDs				[[u'com', u'ru', u'org']]
IP Service				[u'curlmyip.net']
BC Timeout				[u'10']
Timer					[u'20']
Server					[u'110']
64-bit DLL URLs			[[u'zjsgyyq.com/leader/pdf.zip', u'portaldobomretiro.net/wp-admin/network/2.bin', u'colourshield.com/m1/pdd.rtf', u'mukeshjshah.com/admuin/litecoin.rar', u'petras.name/fotos/zek.dmg', u'sbmpowisle.dag.pl/js/989999.sh', u'cdn.robatop.at/jvassets/zarch/xx.dmg']]
Encryption key			[u'Nf6lU8d5X0i1Wr7V']
Value 11				[u'1']
Config Timeout			[u'1200']
DGA CRC					[u'0x4eb7d2ca']
Domains					[[u'inc.robatop.at/wpapi', u'torafy.cn/wpapi', u'app.tohio.at/wpapi', u'scr.tohio.at/wpapi', u'yraco.cn/wpapi', u'poi.robatop.at/wpapi', u'login.cdrome.at/wpapi', u'az.popdel.at/wpapi', u'io.ledal.at/wpapi', u'in.ledal.at/wpapi', u'api.galio.at/wpapi', u'ssl.lottos.at/wpapi', u'harent.cn/wpapi']]
DGA Base URL			[u'constitution.org/usdeclar.txt']
Task Timeout			[u'240']
TOR Domains				[[u'4fsq3wnmms6xqybt.onion/wpapi', u'em2eddryi6ptkcnh.onion/wpapi', u'nap7zb4gtnzwmxsv.onion/wpapi', u't7yz3cihrrzalznq.onion/wpapi']]
32-bit DLL URLs			[u'zjsgyyq.com/leader/doc.zip', u'portaldobomretiro.net/wp-admin/network/1.bin', 			u'colourshield.com/m1/dll.rtf', u'mukeshjshah.com/admuin/coin.rar', u'petras.name/fotos/dash.dmg', u'sbmpowisle.dag.pl/js/757575.sh', u'cdn.robatop.at/jvassets/zarch/x.rar']]