SYMBOLCOMMON_NAMEaka. SYNONYMS
win.gameover_p2p (Back to overview)

Gameover P2P

aka: GOZ, Mapp, ZeuS P2P

Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware. In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.

References
2021-09-09Recorded FutureInsikt Group
@techreport{group:20210909:dark:cd6bb6a, author = {Insikt Group}, title = {{Dark Covenant: Connections Between the Russian State and Criminal Actors}}, date = {2021-09-09}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf}, language = {English}, urldate = {2021-09-10} } Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus
2021-06-08Intel 471Intel 471
@online{471:20210608:blurry:5b278e5, author = {Intel 471}, title = {{The blurry boundaries between nation-state actors and the cybercrime underground}}, date = {2021-06-08}, organization = {Intel 471}, url = {https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state}, language = {English}, urldate = {2021-06-16} } The blurry boundaries between nation-state actors and the cybercrime underground
Dridex Gameover P2P
2021-02-08Lawfare BlogDavid Hechler
@online{hechler:20210208:what:f742cf1, author = {David Hechler}, title = {{What Is the Point of These Nation-State Indictments?}}, date = {2021-02-08}, organization = {Lawfare Blog}, url = {https://www.lawfareblog.com/what-point-these-nation-state-indictments}, language = {English}, urldate = {2021-02-18} } What Is the Point of These Nation-State Indictments?
Gameover P2P Nymaim
2020-07-17CERT-FRCERT-FR
@techreport{certfr:20200717:malware:5c58cdf, author = {CERT-FR}, title = {{The Malware Dridex: Origins and Uses}}, date = {2020-07-17}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf}, language = {English}, urldate = {2020-07-20} } The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2019-12-19KrebsOnSecurityBrian Krebs
@online{krebs:20191219:inside:c7595ad, author = {Brian Krebs}, title = {{Inside ‘Evil Corp,’ a $100M Cybercrime Menace}}, date = {2019-12-19}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/}, language = {English}, urldate = {2020-11-02} } Inside ‘Evil Corp,’ a $100M Cybercrime Menace
Dridex Gameover P2P Zeus Evil Corp
2017-05-15SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20170515:evolution:d0e74ea, author = {Counter Threat Unit ResearchTeam}, title = {{Evolution of the GOLD EVERGREEN Threat Group}}, date = {2017-05-15}, organization = {Secureworks}, url = {https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group}, language = {English}, urldate = {2021-05-28} } Evolution of the GOLD EVERGREEN Threat Group
CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN
2017-03-21WiredGarrett M. Graff, Chad Hagen
@online{graff:20170321:inside:3dc9a2d, author = {Garrett M. Graff and Chad Hagen}, title = {{Inside the Hunt for Russia’s Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/2017/03/russian-hacker-spy-botnet/}, language = {English}, urldate = {2021-07-20} } Inside the Hunt for Russia’s Most Notorious Hacker
Gameover P2P Murofet Zeus
2017-03-21WiredGarrett M. Graff
@online{graff:20170321:inside:dc89cf2, author = {Garrett M. Graff}, title = {{Inside the Hunt for Russia's Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/?p=2171700}, language = {English}, urldate = {2020-01-13} } Inside the Hunt for Russia's Most Notorious Hacker
Gameover P2P
2015-12CERT.PLCERT.PL
@techreport{certpl:201512:zeusp2p:47dc4ed, author = {CERT.PL}, title = {{ZeuS-P2P monitoring and analysis}}, date = {2015-12}, institution = {CERT.PL}, url = {https://www.cert.pl/wp-content/uploads/2015/12/2013-06-p2p-rap_en.pdf}, language = {English}, urldate = {2020-01-13} } ZeuS-P2P monitoring and analysis
Gameover P2P
2015-08-05Black HatMichael Sandee, Tillmann Werner, Elliott Peterson
@techreport{sandee:20150805:gameover:fa47096, author = {Michael Sandee and Tillmann Werner and Elliott Peterson}, title = {{Gameover Zeus – Bad Guys and Backends}}, date = {2015-08-05}, institution = {Black Hat}, url = {https://www.blackhat.com/docs/us-15/materials/us-15-Peterson-GameOver-Zeus-Badguys-And-Backends.pdf}, language = {English}, urldate = {2020-01-06} } Gameover Zeus – Bad Guys and Backends
Gameover P2P
2015-02-06CrowdStrikeCrowdStrike
@techreport{crowdstrike:20150206:crowdstrike:fbcc37f, author = {CrowdStrike}, title = {{CrowdStrike Global Threat Intel Report 2014}}, date = {2015-02-06}, institution = {CrowdStrike}, url = {https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf}, language = {English}, urldate = {2020-05-11} } CrowdStrike Global Threat Intel Report 2014
BlackPOS CryptoLocker Derusbi Elise Enfal EvilGrab Gameover P2P HttpBrowser Medusa Mirage Naikon NetTraveler pirpi PlugX Poison Ivy Sakula RAT Sinowal sykipot taidoor
2014-10-14SymantecSymantec Security Response
@online{response:20141014:security:81c5ea5, author = {Symantec Security Response}, title = {{Security vendors take action against Hidden Lynx malware}}, date = {2014-10-14}, organization = {Symantec}, url = {https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware}, language = {English}, urldate = {2020-04-21} } Security vendors take action against Hidden Lynx malware
Gameover P2P HiKit Shylock Aurora Panda
2013-10MALWARE ConferenceDennis Andriesse, Christian Rossow, Brett Stone-Gross, Daniel Plohmann, Herbert Bos
@techreport{andriesse:201310:highly:bc65090, author = {Dennis Andriesse and Christian Rossow and Brett Stone-Gross and Daniel Plohmann and Herbert Bos}, title = {{Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus}}, date = {2013-10}, institution = {MALWARE Conference}, url = {http://www.syssec-project.eu/m/page-media/3/zeus_malware13.pdf}, language = {English}, urldate = {2020-01-08} } Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus
Gameover P2P
Yara Rules
[TLP:WHITE] win_gameover_p2p_auto (20210616 | Detects win.gameover_p2p.)
rule win_gameover_p2p_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.gameover_p2p."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b08 52 50 ff5120 85c0 750b 66837c2414ff }
            // n = 7, score = 100
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   52                   | push                edx
            //   50                   | push                eax
            //   ff5120               | call                dword ptr [ecx + 0x20]
            //   85c0                 | test                eax, eax
            //   750b                 | jne                 0xd
            //   66837c2414ff         | cmp                 word ptr [esp + 0x14], -1

        $sequence_1 = { bae8030000 b90f270000 6685c0 740a 663bc2 }
            // n = 5, score = 100
            //   bae8030000           | mov                 edx, 0x3e8
            //   b90f270000           | mov                 ecx, 0x270f
            //   6685c0               | test                ax, ax
            //   740a                 | je                  0xc
            //   663bc2               | cmp                 ax, dx

        $sequence_2 = { 55 8bec 8b01 83e800 746c 48 7453 }
            // n = 7, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   83e800               | sub                 eax, 0
            //   746c                 | je                  0x6e
            //   48                   | dec                 eax
            //   7453                 | je                  0x55

        $sequence_3 = { 50 6aff ff15???????? 85c0 7506 895c2410 eb24 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   6aff                 | push                -1
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7506                 | jne                 8
            //   895c2410             | mov                 dword ptr [esp + 0x10], ebx
            //   eb24                 | jmp                 0x26

        $sequence_4 = { 740a 33c0 3945fc 0f95c0 c9 c3 32c0 }
            // n = 7, score = 100
            //   740a                 | je                  0xc
            //   33c0                 | xor                 eax, eax
            //   3945fc               | cmp                 dword ptr [ebp - 4], eax
            //   0f95c0               | setne               al
            //   c9                   | leave               
            //   c3                   | ret                 
            //   32c0                 | xor                 al, al

        $sequence_5 = { 33510c 8bc2 c1e810 25ff000000 8b0485e82f3902 8bda c1eb08 }
            // n = 7, score = 100
            //   33510c               | xor                 edx, dword ptr [ecx + 0xc]
            //   8bc2                 | mov                 eax, edx
            //   c1e810               | shr                 eax, 0x10
            //   25ff000000           | and                 eax, 0xff
            //   8b0485e82f3902       | mov                 eax, dword ptr [eax*4 + 0x2392fe8]
            //   8bda                 | mov                 ebx, edx
            //   c1eb08               | shr                 ebx, 8

        $sequence_6 = { ff15???????? b001 c3 32c0 c3 33c0 c3 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   b001                 | mov                 al, 1
            //   c3                   | ret                 
            //   32c0                 | xor                 al, al
            //   c3                   | ret                 
            //   33c0                 | xor                 eax, eax
            //   c3                   | ret                 

        $sequence_7 = { 57 8954241c 89742418 3bdd 7e07 33c0 e9???????? }
            // n = 7, score = 100
            //   57                   | push                edi
            //   8954241c             | mov                 dword ptr [esp + 0x1c], edx
            //   89742418             | mov                 dword ptr [esp + 0x18], esi
            //   3bdd                 | cmp                 ebx, ebp
            //   7e07                 | jle                 9
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     

        $sequence_8 = { 8d827c0a0000 c782200b000000203d02 c7822c0b000014203d02 8982300b0000 c782380b000028203d02 66898ab8160000 898abc160000 }
            // n = 7, score = 100
            //   8d827c0a0000         | lea                 eax, dword ptr [edx + 0xa7c]
            //   c782200b000000203d02     | mov    dword ptr [edx + 0xb20], 0x23d2000
            //   c7822c0b000014203d02     | mov    dword ptr [edx + 0xb2c], 0x23d2014
            //   8982300b0000         | mov                 dword ptr [edx + 0xb30], eax
            //   c782380b000028203d02     | mov    dword ptr [edx + 0xb38], 0x23d2028
            //   66898ab8160000       | mov                 word ptr [edx + 0x16b8], cx
            //   898abc160000         | mov                 dword ptr [edx + 0x16bc], ecx

        $sequence_9 = { 59 2bc8 d3e2 8bf2 }
            // n = 4, score = 100
            //   59                   | pop                 ecx
            //   2bc8                 | sub                 ecx, eax
            //   d3e2                 | shl                 edx, cl
            //   8bf2                 | mov                 esi, edx

    condition:
        7 of them and filesize < 598016
}
Download all Yara Rules