gozi | 2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar
Size 17.0MB
Sample260729-c94z2sfm21
SHA256 b74f1ea44466fce60a53a3ae7d9b04aa12c2fe2631baf2f803076804dde43a07
MD5 4f09c6b3b1372af4670a6b040c0ae483
SHA1 ab45134d7e0a3a0d54720dc5f199e94723581610
SHA512 52badf87e2c1f9d2244333c8178a095c17c4ef7c9fbb1005a5d698801cf388eaf6e6293f16b022942945bd0865c3227d04ae3bc6da474aa58ad9d6d73e448151
SSDEEP 393216:wio/psd3rJbd2Nf2DfdvOchxbtMBZMRa5Mftgd6:wDRsd3rMu7ztMBuRVt
TLSH
T111077BB7F2418A70E57FC171666AFC6C7A9974C398C482550F7E2020AE81FFC2EA5D58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

isfb banker trojan gozi

Malware Config

Extracted

Family

gozi

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Detects executables packed with Babel 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Babel

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with Goliath 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Goliath

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Yano

Detects executables packed with dotNetProtector 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_dotNetProtector

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar

File Explorer

2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar

.exe 17.0MB

2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar

SHA256 b74f1ea44466fce60a53a3ae7d9b04aa12c2fe2631baf2f803076804dde43a07
MD5 4f09c6b3b1372af4670a6b040c0ae483
SHA1 ab45134d7e0a3a0d54720dc5f199e94723581610
SHA512 52badf87e2c1f9d2244333c8178a095c17c4ef7c9fbb1005a5d698801cf388eaf6e6293f16b022942945bd0865c3227d04ae3bc6da474aa58ad9d6d73e448151
SSDEEP 393216:wio/psd3rJbd2Nf2DfdvOchxbtMBZMRa5Mftgd6:wDRsd3rMu7ztMBuRVt
TLSH
T111077BB7F2418A70E57FC171666AFC6C7A9974C398C482550F7E2020AE81FFC2EA5D58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Detects executables packed with Babel
Detects executables packed with Dotfuscator
Detects executables packed with Goliath
Detects executables packed with SmartAssembly
Detects executables packed with Yano Obfuscator
Detects executables packed with dotNetProtector
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths