gozi | 02429d80ed16c094dca178f4bf98799c6dc3654597a8edf02153ec976f9e6c19

General

Target
2026-08-28_5287a01b155b54f7ed7a17b18ce6fca0_elex_glassworm_hammertoss_icedid
Size 2.7MB
Sample260830-c2hf3sxgla
SHA256 02429d80ed16c094dca178f4bf98799c6dc3654597a8edf02153ec976f9e6c19
MD5 5287a01b155b54f7ed7a17b18ce6fca0
SHA1 231a9e771fae82d700251b541a634499ab6bd65e
SHA512 e2d6bd7b0bef42a24e33200a62b8d4617277f3ea38b0c7520416af24aa187a1858eace6d46e235b101d2ff4cceb0fb3be1901242ddfff38b97370f3bfd67e9b9
SSDEEP 49152:2C5QG7uz9NQvyQuBxMp5AlXKQ4x9VWIoIxwv9CfT:2KQG7uBNCyQ3pWlXK/DBogwC
TLSH
T1F8D5BFD962D0A486E71E7F72C5F2F499C7756022B285E7872A83421B0F113F23C5ADDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  2026-08-28_5287a01b155b54f7ed7a17b18ce6fca0_elex_glassworm_hammertoss_icedid
- Size 2.7MB
- SHA256 02429d80ed16c094dca178f4bf98799c6dc3654597a8edf02153ec976f9e6c19
- MD5 5287a01b155b54f7ed7a17b18ce6fca0
- SHA1 231a9e771fae82d700251b541a634499ab6bd65e
- SHA512 e2d6bd7b0bef42a24e33200a62b8d4617277f3ea38b0c7520416af24aa187a1858eace6d46e235b101d2ff4cceb0fb3be1901242ddfff38b97370f3bfd67e9b9
- SSDEEP 49152:2C5QG7uz9NQvyQuBxMp5AlXKQ4x9VWIoIxwv9CfT:2KQG7uBNCyQ3pWlXK/DBogwC
- TLSH
  T1F8D5BFD962D0A486E71E7F72C5F2F499C7756022B285E7872A83421B0F113F23C5ADDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker costura discovery gozi isfb packer trojan
- Family: Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables manipulated with Fody
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

5

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Gozi

Detects executables manipulated with Fody

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2