gozi | 72486c54703dcecb2d4e0b3283f6261737b05724c73d05cfe078165fe105a35d

General

Target
2026-09-03_94ff0ef36bed6da757037548baf652ca_elex_glassworm_hammertoss_icedid
Size 3.2MB
Sample260904-eq79gadc39
SHA256 72486c54703dcecb2d4e0b3283f6261737b05724c73d05cfe078165fe105a35d
MD5 94ff0ef36bed6da757037548baf652ca
SHA1 e4d72a25bb1409ce9cec520af075e337ffa7c289
SHA512 f95dc343ab0898f7d372119c851ed8c74a778fa0ff408a76de63bc9d64ca608331cd8f4bce395656cc590dc0eb30e40acba5c0480e9eb65e65d280d1e6fa73a4
SSDEEP 49152:QC5QG7uz9NQvyQuBxMp5AlXKQ4x9VWIoIx5KRIUqd9rW7bcwDWaSyEYl:QKQG7uBNCyQ3pWlXK/DBogjd9qbRFFE4
TLSH
T157F5D0D962D0A486E71E7F72D5F2F489D7756022B285E7872A87421B0F113F23C1ACDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  2026-09-03_94ff0ef36bed6da757037548baf652ca_elex_glassworm_hammertoss_icedid
- Size 3.2MB
- SHA256 72486c54703dcecb2d4e0b3283f6261737b05724c73d05cfe078165fe105a35d
- MD5 94ff0ef36bed6da757037548baf652ca
- SHA1 e4d72a25bb1409ce9cec520af075e337ffa7c289
- SHA512 f95dc343ab0898f7d372119c851ed8c74a778fa0ff408a76de63bc9d64ca608331cd8f4bce395656cc590dc0eb30e40acba5c0480e9eb65e65d280d1e6fa73a4
- SSDEEP 49152:QC5QG7uz9NQvyQuBxMp5AlXKQ4x9VWIoIx5KRIUqd9rW7bcwDWaSyEYl:QKQG7uBNCyQ3pWlXK/DBogjd9qbRFFE4
- TLSH
  T157F5D0D962D0A486E71E7F72D5F2F489D7756022B285E7872A87421B0F113F23C1ACDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker costura discovery gozi isfb packer trojan
- Family: Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables manipulated with Fody
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

5

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Gozi

Detects executables manipulated with Fody

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2