gozi | 493094b5f154c4a3e53766e52969ef709348496de1c37462f81e961393eb4c6d

General

Target
2026-08-30_ebc2f25f0d2c61a6528ee012a5104475_elex_glassworm_hammertoss_icedid
Size 3.3MB
Sample260830-mvc8wsbq9t
SHA256 493094b5f154c4a3e53766e52969ef709348496de1c37462f81e961393eb4c6d
MD5 ebc2f25f0d2c61a6528ee012a5104475
SHA1 95827ee83cfc18fbc0358dc87c57de1a8517d47d
SHA512 3d504866a06a6554da407bf4b08238bb19a009069cfe70d1e5e220a8a415bd0a3650a995c1a1585588668b3ea5a197480b448ac5bd78c6e6df47b17133e05c89
SSDEEP 98304:2KQG7uBNCyQ3pWlXK/DBogvw1tAdDRG+y7:2xGgzXK/DBo6mtk4+I
TLSH
T14AF5D0D972D0A486E71E7B72C5F2F499C7756022B285E7872A87421B0F113F23C1ADDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  2026-08-30_ebc2f25f0d2c61a6528ee012a5104475_elex_glassworm_hammertoss_icedid
- Size 3.3MB
- SHA256 493094b5f154c4a3e53766e52969ef709348496de1c37462f81e961393eb4c6d
- MD5 ebc2f25f0d2c61a6528ee012a5104475
- SHA1 95827ee83cfc18fbc0358dc87c57de1a8517d47d
- SHA512 3d504866a06a6554da407bf4b08238bb19a009069cfe70d1e5e220a8a415bd0a3650a995c1a1585588668b3ea5a197480b448ac5bd78c6e6df47b17133e05c89
- SSDEEP 98304:2KQG7uBNCyQ3pWlXK/DBogvw1tAdDRG+y7:2xGgzXK/DBo6mtk4+I
- TLSH
  T14AF5D0D972D0A486E71E7B72C5F2F499C7756022B285E7872A87421B0F113F23C1ADDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker costura discovery gozi isfb packer trojan
- Family: Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables manipulated with Fody
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

5

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Gozi

Detects executables manipulated with Fody

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2