7-18-2018: #Gozi #ISFB Botnet "201872" JP tor=1

MD5: a04f84cde39b2dae57b25e604e7139e9

Botnet ID       	['201872']
Bot version     	['2.16']
Bot build       	['996']
Server id       	['12']
Crc hash        	['64efb6f']
IP Service			['curlmyip.net']
32-bit TOR DLL URLs	['upload-speed.icu/images/1.png', 'file://c:\\test\\test32.dll']
64-bit TOR DLL URLs	['upload-speed.icu/images/2.png', 'file://c:\\test\\tor64.dll']
Encryption key		['s4Sc9mDb35Ayj8oO']
DGA CRC				['0x4eb7d2ca']
Domains				['hu.ecologicindustries.com']
DGA Base URL		['constitution.org/usdeclar.txt']
TOR Domains			['iod5tem372udbzu2.onion']

URI Path:

/images/