We see you, Gozi

This report analyzes a June 2022 sample of the ISFB/Gozi banking Trojan, detailing a multi-stage in-memory kill chain where an initial self-extracting EXE launches a .NET downloader, which fetches an obfuscated .NET packer from a Discord CDN via a URL shortener; the packer decrypts and unpacks a Gozi downloader DLL that attempts to contact C2 servers to retrieve the main module. The write-up includes a high-level breakdown of each stage, the Gozi downloader configuration, and IOCs (file hashes, filenames, and network URLs) observed during the investigation.