11-1-2018: Gozi ISFB

MD5 (11-01-2018.isfb.loader.decoded.vk.exe) = c9eac3fb35e78c5a97b8fccb99fb485b
MD5 (11-01-2018.isfb.client.decoded.vk.dll) = 3d5899ca248ec761f04bfa204ee354b5


Bot                     ['3.00']
Build                   ['665']
Botnet/Group ID         ['40001']
DGA TLDs                ['com', 'ru', 'org']
Server                  [’12’]
Encryption key          ['3gtG7qkO5WcgxyJh']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['https://chicmall.com']