SYMBOLCOMMON_NAMEaka. SYNONYMS
win.gameover_p2p (Back to overview)

Gameover P2P

aka: GOZ, Mapp, ZeuS P2P

Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware. In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.

References
2021-09-09Recorded FutureInsikt Group
@techreport{group:20210909:dark:cd6bb6a, author = {Insikt Group}, title = {{Dark Covenant: Connections Between the Russian State and Criminal Actors}}, date = {2021-09-09}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf}, language = {English}, urldate = {2021-09-10} } Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus
2021-06-08Intel 471Intel 471
@online{471:20210608:blurry:5b278e5, author = {Intel 471}, title = {{The blurry boundaries between nation-state actors and the cybercrime underground}}, date = {2021-06-08}, organization = {Intel 471}, url = {https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state}, language = {English}, urldate = {2021-06-16} } The blurry boundaries between nation-state actors and the cybercrime underground
Dridex Gameover P2P
2021-02-08Lawfare BlogDavid Hechler
@online{hechler:20210208:what:f742cf1, author = {David Hechler}, title = {{What Is the Point of These Nation-State Indictments?}}, date = {2021-02-08}, organization = {Lawfare Blog}, url = {https://www.lawfareblog.com/what-point-these-nation-state-indictments}, language = {English}, urldate = {2021-02-18} } What Is the Point of These Nation-State Indictments?
Gameover P2P Nymaim
2020-07-17CERT-FRCERT-FR
@techreport{certfr:20200717:malware:5c58cdf, author = {CERT-FR}, title = {{The Malware Dridex: Origins and Uses}}, date = {2020-07-17}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf}, language = {English}, urldate = {2020-07-20} } The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2019-12-19KrebsOnSecurityBrian Krebs
@online{krebs:20191219:inside:c7595ad, author = {Brian Krebs}, title = {{Inside ‘Evil Corp,’ a $100M Cybercrime Menace}}, date = {2019-12-19}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/}, language = {English}, urldate = {2020-11-02} } Inside ‘Evil Corp,’ a $100M Cybercrime Menace
Dridex Gameover P2P Zeus Evil Corp
2017-05-15SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20170515:evolution:d0e74ea, author = {Counter Threat Unit ResearchTeam}, title = {{Evolution of the GOLD EVERGREEN Threat Group}}, date = {2017-05-15}, organization = {Secureworks}, url = {https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group}, language = {English}, urldate = {2021-05-28} } Evolution of the GOLD EVERGREEN Threat Group
CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN
2017-03-21WiredGarrett M. Graff, Chad Hagen
@online{graff:20170321:inside:3dc9a2d, author = {Garrett M. Graff and Chad Hagen}, title = {{Inside the Hunt for Russia’s Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/2017/03/russian-hacker-spy-botnet/}, language = {English}, urldate = {2021-07-20} } Inside the Hunt for Russia’s Most Notorious Hacker
Gameover P2P Murofet Zeus
2017-03-21WiredGarrett M. Graff
@online{graff:20170321:inside:dc89cf2, author = {Garrett M. Graff}, title = {{Inside the Hunt for Russia's Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/?p=2171700}, language = {English}, urldate = {2020-01-13} } Inside the Hunt for Russia's Most Notorious Hacker
Gameover P2P
2015-12CERT.PLCERT.PL
@techreport{certpl:201512:zeusp2p:47dc4ed, author = {CERT.PL}, title = {{ZeuS-P2P monitoring and analysis}}, date = {2015-12}, institution = {CERT.PL}, url = {https://www.cert.pl/wp-content/uploads/2015/12/2013-06-p2p-rap_en.pdf}, language = {English}, urldate = {2020-01-13} } ZeuS-P2P monitoring and analysis
Gameover P2P
2015-08-05Black HatMichael Sandee, Tillmann Werner, Elliott Peterson
@techreport{sandee:20150805:gameover:fa47096, author = {Michael Sandee and Tillmann Werner and Elliott Peterson}, title = {{Gameover Zeus – Bad Guys and Backends}}, date = {2015-08-05}, institution = {Black Hat}, url = {https://www.blackhat.com/docs/us-15/materials/us-15-Peterson-GameOver-Zeus-Badguys-And-Backends.pdf}, language = {English}, urldate = {2020-01-06} } Gameover Zeus – Bad Guys and Backends
Gameover P2P
2015-02-06CrowdStrikeCrowdStrike
@techreport{crowdstrike:20150206:crowdstrike:fbcc37f, author = {CrowdStrike}, title = {{CrowdStrike Global Threat Intel Report 2014}}, date = {2015-02-06}, institution = {CrowdStrike}, url = {https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf}, language = {English}, urldate = {2020-05-11} } CrowdStrike Global Threat Intel Report 2014
BlackPOS CryptoLocker Derusbi Elise Enfal EvilGrab Gameover P2P HttpBrowser Medusa Mirage Naikon NetTraveler pirpi PlugX Poison Ivy Sakula RAT Sinowal sykipot taidoor
2014-10-14SymantecSymantec Security Response
@online{response:20141014:security:81c5ea5, author = {Symantec Security Response}, title = {{Security vendors take action against Hidden Lynx malware}}, date = {2014-10-14}, organization = {Symantec}, url = {https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware}, language = {English}, urldate = {2020-04-21} } Security vendors take action against Hidden Lynx malware
Gameover P2P HiKit Shylock Aurora Panda
2013-10MALWARE ConferenceDennis Andriesse, Christian Rossow, Brett Stone-Gross, Daniel Plohmann, Herbert Bos
@techreport{andriesse:201310:highly:bc65090, author = {Dennis Andriesse and Christian Rossow and Brett Stone-Gross and Daniel Plohmann and Herbert Bos}, title = {{Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus}}, date = {2013-10}, institution = {MALWARE Conference}, url = {http://www.syssec-project.eu/m/page-media/3/zeus_malware13.pdf}, language = {English}, urldate = {2020-01-08} } Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus
Gameover P2P
Yara Rules
[TLP:WHITE] win_gameover_p2p_auto (20211008 | Detects win.gameover_p2p.)
rule win_gameover_p2p_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.gameover_p2p."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b442418 8b4c2414 6a03 83c008 83c104 50 51 }
            // n = 7, score = 100
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]
            //   8b4c2414             | mov                 ecx, dword ptr [esp + 0x14]
            //   6a03                 | push                3
            //   83c008               | add                 eax, 8
            //   83c104               | add                 ecx, 4
            //   50                   | push                eax
            //   51                   | push                ecx

        $sequence_1 = { 8937 e8???????? 8b84241c020000 8d8f80000000 89477c e8???????? 8364241000 }
            // n = 7, score = 100
            //   8937                 | mov                 dword ptr [edi], esi
            //   e8????????           |                     
            //   8b84241c020000       | mov                 eax, dword ptr [esp + 0x21c]
            //   8d8f80000000         | lea                 ecx, dword ptr [edi + 0x80]
            //   89477c               | mov                 dword ptr [edi + 0x7c], eax
            //   e8????????           |                     
            //   8364241000           | and                 dword ptr [esp + 0x10], 0

        $sequence_2 = { 7447 8d4e0b 0fb74609 8b542418 51 50 51 }
            // n = 7, score = 100
            //   7447                 | je                  0x49
            //   8d4e0b               | lea                 ecx, dword ptr [esi + 0xb]
            //   0fb74609             | movzx               eax, word ptr [esi + 9]
            //   8b542418             | mov                 edx, dword ptr [esp + 0x18]
            //   51                   | push                ecx
            //   50                   | push                eax
            //   51                   | push                ecx

        $sequence_3 = { 895c2438 896c2440 895c242c 895c2434 }
            // n = 4, score = 100
            //   895c2438             | mov                 dword ptr [esp + 0x38], ebx
            //   896c2440             | mov                 dword ptr [esp + 0x40], ebp
            //   895c242c             | mov                 dword ptr [esp + 0x2c], ebx
            //   895c2434             | mov                 dword ptr [esp + 0x34], ebx

        $sequence_4 = { ff75fc 8b4d0c ba04010000 e8???????? 8bf0 ff75fc ff15???????? }
            // n = 7, score = 100
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   ba04010000           | mov                 edx, 0x104
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   ff15????????         |                     

        $sequence_5 = { 897c2414 85ff 0f8405030000 8b6c2418 85ed 0f84f2020000 8bcd }
            // n = 7, score = 100
            //   897c2414             | mov                 dword ptr [esp + 0x14], edi
            //   85ff                 | test                edi, edi
            //   0f8405030000         | je                  0x30b
            //   8b6c2418             | mov                 ebp, dword ptr [esp + 0x18]
            //   85ed                 | test                ebp, ebp
            //   0f84f2020000         | je                  0x2f8
            //   8bcd                 | mov                 ecx, ebp

        $sequence_6 = { 8b7c240c 8b17 0fb64203 83e868 7417 48 48 }
            // n = 7, score = 100
            //   8b7c240c             | mov                 edi, dword ptr [esp + 0xc]
            //   8b17                 | mov                 edx, dword ptr [edi]
            //   0fb64203             | movzx               eax, byte ptr [edx + 3]
            //   83e868               | sub                 eax, 0x68
            //   7417                 | je                  0x19
            //   48                   | dec                 eax
            //   48                   | dec                 eax

        $sequence_7 = { 55 8bec 83e4f8 81eca0080000 53 55 56 }
            // n = 7, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83e4f8               | and                 esp, 0xfffffff8
            //   81eca0080000         | sub                 esp, 0x8a0
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   56                   | push                esi

        $sequence_8 = { 8955e0 8975e4 83e868 7429 2bc3 7425 83e85e }
            // n = 7, score = 100
            //   8955e0               | mov                 dword ptr [ebp - 0x20], edx
            //   8975e4               | mov                 dword ptr [ebp - 0x1c], esi
            //   83e868               | sub                 eax, 0x68
            //   7429                 | je                  0x2b
            //   2bc3                 | sub                 eax, ebx
            //   7425                 | je                  0x27
            //   83e85e               | sub                 eax, 0x5e

        $sequence_9 = { 894dcc 8d4ddc 51 6880000000 50 57 ff15???????? }
            // n = 7, score = 100
            //   894dcc               | mov                 dword ptr [ebp - 0x34], ecx
            //   8d4ddc               | lea                 ecx, dword ptr [ebp - 0x24]
            //   51                   | push                ecx
            //   6880000000           | push                0x80
            //   50                   | push                eax
            //   57                   | push                edi
            //   ff15????????         |                     

    condition:
        7 of them and filesize < 598016
}
Download all Yara Rules