gozi | 2e64bcf7031d3082bc3778bdb479c1b8037d647598c10af4318c4e6480fae577

General

Target
2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid
Size 4.3MB
Sample260904-e1m2aax1fz
SHA256 2e64bcf7031d3082bc3778bdb479c1b8037d647598c10af4318c4e6480fae577
MD5 9253a49b86bcac4c66363f3e728a4598
SHA1 4d32b3747a68ec7ae171e2e19563b7c8d6903234
SHA512 67b0ad30e393c32b9b8bb86e057f67d2e865ca23886e1c09c426c207619d16b15c624f6b59fabe06676c82c88fcd2cedf65b92192daa4fb22e3365cf5a00c029
SSDEEP 98304:sKQG7uBNCyQ3pWlXK/DBogTw1tAdDRG+y9HA5cvbF6P:sxGgzXK/DBoemtk4+uPvbAP
TLSH
T14026E19972D0A486E71E3F72D5F2F499D7756022B285E7872A87421B0F113F23C1ACDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid
- Size 4.3MB
- SHA256 2e64bcf7031d3082bc3778bdb479c1b8037d647598c10af4318c4e6480fae577
- MD5 9253a49b86bcac4c66363f3e728a4598
- SHA1 4d32b3747a68ec7ae171e2e19563b7c8d6903234
- SHA512 67b0ad30e393c32b9b8bb86e057f67d2e865ca23886e1c09c426c207619d16b15c624f6b59fabe06676c82c88fcd2cedf65b92192daa4fb22e3365cf5a00c029
- SSDEEP 98304:sKQG7uBNCyQ3pWlXK/DBogTw1tAdDRG+y9HA5cvbF6P:sxGgzXK/DBoemtk4+uPvbAP
- TLSH
  T14026E19972D0A486E71E3F72D5F2F499D7756022B285E7872A87421B0F113F23C1ACDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker costura discovery gozi isfb packer trojan
- Family: Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables manipulated with Fody
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

5

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Gozi

Detects executables manipulated with Fody

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2