2018-12-06: ISFB Gozi v215

MD5 (2018-12-06.isfbv215.loader.decoded.vk.exe) = d0fb46b6f85c148d16c8b0b1014dfd9d
MD5 (2018-12-06.isfbv215.loader.decoded.vk.exe) = 63bf415bf29da3a80cf944bd734ef196

Bot                     ['2.15']
Build                   ['165']
Botnet/Group ID         ['3142', '3143']
DGA TLDs                ['com', 'ru', 'org']
Server                  [’12’]
Encryption key          ['10291029JSJUYNHG']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['hazzanaphi.com', 'coelloemai.com', 'outtersoco.com']
Path:                   ['/images/']

Bot                     ['2.15']
Build                   ['165']
Botnet/Group ID         ['3144', '3144']
DGA TLDs                ['com', 'ru', 'org']
Server                  [’12’]
Encryption key          ['10291029JSJUYNHG']
DGA CRC                 ['0x4eb7d2ca']
DGA Base URL            ['constitution.org/usdeclar.txt']
Domains                 ['foxerwoman.com', 'ralmonresc.com', 'bartatoisc.com']
Path:                   ['/images/']


Payload Domains

tolinatogr.com/KHZ/diuyz.php?l=aque[1-14].tkn
killoberil.com/KHZ/diuyz.php?l=tysk[1-14].tkn