gozi | ac7f004e0316e991d7a16527fa13b7a53fd0b2102df8596c3047df4ec765b258

General

Target
2026-09-06_73b1087c1b4de7e60416850b9ab2f10f_elex_glassworm_hammertoss_icedid
Size 5.2MB
Sample260907-a7yn5swaqe
SHA256 ac7f004e0316e991d7a16527fa13b7a53fd0b2102df8596c3047df4ec765b258
MD5 73b1087c1b4de7e60416850b9ab2f10f
SHA1 2983eb7c784c4d21ce33129a758403129fabc2f5
SHA512 f4a5ff1c93b8d867769187ff806f91ce842d133ab4d393ffc0a937221d321941a5abac296de5f67b2bf1c55813195ab958c64a997bebaf7829e30f7812bce22c
SSDEEP 98304:lKQG7uBNCyQ3pWlXK/DBogeGVTu69cvEzq3kwk20v3lgia7mTLC1:lxGgzXK/DBoDgu69ne+qvwo
TLSH
T1B846F19961D0A486E71E7F72D5F2F499C7796023B285E7872A83421B0F113F23C1ADDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  2026-09-06_73b1087c1b4de7e60416850b9ab2f10f_elex_glassworm_hammertoss_icedid
- Size 5.2MB
- SHA256 ac7f004e0316e991d7a16527fa13b7a53fd0b2102df8596c3047df4ec765b258
- MD5 73b1087c1b4de7e60416850b9ab2f10f
- SHA1 2983eb7c784c4d21ce33129a758403129fabc2f5
- SHA512 f4a5ff1c93b8d867769187ff806f91ce842d133ab4d393ffc0a937221d321941a5abac296de5f67b2bf1c55813195ab958c64a997bebaf7829e30f7812bce22c
- SSDEEP 98304:lKQG7uBNCyQ3pWlXK/DBogeGVTu69cvEzq3kwk20v3lgia7mTLC1:lxGgzXK/DBoDgu69ne+qvwo
- TLSH
  T1B846F19961D0A486E71E7F72D5F2F499C7796023B285E7872A83421B0F113F23C1ADDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker costura discovery gozi isfb packer trojan
- Family: Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables manipulated with Fody
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

5

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Gozi

Detects executables manipulated with Fody

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2