dvk01uk/status/1089015478180343808

https://twitter.com/dvk01uk/status/1089015478180343808

https://ethernalsource.club/invoice_898427.doc   (403 if geo not met - CAN)
ethernalsource.club|198.54.120.132


invoice_898427.doc
File Size: 75648 Byte(s) (73.88 KB)
MD5: a7f8e0901fea23e130ccd7d74b7a0ae4
SHA1: 362529b30c488aaecf7bf5bb5361e78736dcd5ef
SHA256: 7fc746e23ffb42ef749b9205ddfd10a97f09d2ebf14211e3b6b4d024f1468040

GET https://globalinvoice.club/update.php HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: globalinvoice.club
Connection: Keep-Alive



https://globalinvoice.club/update.php
globalinvoice.club|198.54.120.132

update.exe
File Size: 307200 Byte(s) (300.00 KB)
MD5: d369a3a0c25fc211ee68d997c73b5ace
SHA1: a88d2bbfd83498e5d62ba93ee56d77f09d3ad238
SHA256: b6e39f135090d7cd712a723267a7b6a50d52c9501ff4d28946b923825a32981d


Gozi Loader C2:
mastersblasters.club|54.37.196.112

Gozi Worker C2:
167.114.57.102

Gozi Task
http://gamblchange.club/update.rar
gamblchange.club|198.54.120.132

65342484.exe
File Size: 482304 Byte(s) (471.00 KB)
MD5: 4808b8945ada00685b8fc42103329f3b
SHA1: e44dbdd078a10af94671500d0d9f5297e7b52d50
SHA256: 0a5b84624c0cff2f99f1d2177dde289a0b1b8f92005edf6c76768e8b5aaf3ee5

http://monstercartune.club/03SleOcRkLyD69DQ/gate.php
http://monstercartune.club/03SleOcRkLyD69DQ/gate.php

monstercartune.club|185.158.249.240