SYMBOLCOMMON_NAMEaka. SYNONYMS
win.gameover_p2p (Back to overview)

Gameover P2P

aka: GOZ, Mapp, ZeuS P2P

Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware. In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.

References
2022-04-27ANSSIANSSI
@techreport{anssi:20220427:le:5d47343, author = {ANSSI}, title = {{LE GROUPE CYBERCRIMINEL FIN7}}, date = {2022-04-27}, institution = {ANSSI}, url = {https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf}, language = {French}, urldate = {2022-05-05} } LE GROUPE CYBERCRIMINEL FIN7
Bateleur BELLHOP Griffon SQLRat POWERSOURCE Andromeda BABYMETAL BlackCat BlackMatter BOOSTWRITE Carbanak Cobalt Strike DNSMessenger Dridex DRIFTPIN Gameover P2P MimiKatz Murofet Qadars Ranbyus SocksBot
2021-09-09Recorded FutureInsikt Group
@techreport{group:20210909:dark:cd6bb6a, author = {Insikt Group}, title = {{Dark Covenant: Connections Between the Russian State and Criminal Actors}}, date = {2021-09-09}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf}, language = {English}, urldate = {2021-09-10} } Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus
2021-06-08Intel 471Intel 471
@online{471:20210608:blurry:5b278e5, author = {Intel 471}, title = {{The blurry boundaries between nation-state actors and the cybercrime underground}}, date = {2021-06-08}, organization = {Intel 471}, url = {https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state}, language = {English}, urldate = {2021-06-16} } The blurry boundaries between nation-state actors and the cybercrime underground
Dridex Gameover P2P
2021-02-08Lawfare BlogDavid Hechler
@online{hechler:20210208:what:f742cf1, author = {David Hechler}, title = {{What Is the Point of These Nation-State Indictments?}}, date = {2021-02-08}, organization = {Lawfare Blog}, url = {https://www.lawfareblog.com/what-point-these-nation-state-indictments}, language = {English}, urldate = {2021-02-18} } What Is the Point of These Nation-State Indictments?
Gameover P2P Nymaim
2020-07-17CERT-FRCERT-FR
@techreport{certfr:20200717:malware:5c58cdf, author = {CERT-FR}, title = {{The Malware Dridex: Origins and Uses}}, date = {2020-07-17}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf}, language = {English}, urldate = {2020-07-20} } The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2019-12-19KrebsOnSecurityBrian Krebs
@online{krebs:20191219:inside:c7595ad, author = {Brian Krebs}, title = {{Inside ‘Evil Corp,’ a $100M Cybercrime Menace}}, date = {2019-12-19}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/}, language = {English}, urldate = {2020-11-02} } Inside ‘Evil Corp,’ a $100M Cybercrime Menace
Dridex Gameover P2P Zeus Evil Corp
2017-05-15SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20170515:evolution:d0e74ea, author = {Counter Threat Unit ResearchTeam}, title = {{Evolution of the GOLD EVERGREEN Threat Group}}, date = {2017-05-15}, organization = {Secureworks}, url = {https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group}, language = {English}, urldate = {2021-05-28} } Evolution of the GOLD EVERGREEN Threat Group
CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN
2017-03-21WiredGarrett M. Graff
@online{graff:20170321:inside:dc89cf2, author = {Garrett M. Graff}, title = {{Inside the Hunt for Russia's Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/?p=2171700}, language = {English}, urldate = {2020-01-13} } Inside the Hunt for Russia's Most Notorious Hacker
Gameover P2P
2017-03-21WiredGarrett M. Graff, Chad Hagen
@online{graff:20170321:inside:3dc9a2d, author = {Garrett M. Graff and Chad Hagen}, title = {{Inside the Hunt for Russia’s Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/2017/03/russian-hacker-spy-botnet/}, language = {English}, urldate = {2021-07-20} } Inside the Hunt for Russia’s Most Notorious Hacker
Gameover P2P Murofet Zeus
2015-12CERT.PLCERT.PL
@techreport{certpl:201512:zeusp2p:47dc4ed, author = {CERT.PL}, title = {{ZeuS-P2P monitoring and analysis}}, date = {2015-12}, institution = {CERT.PL}, url = {https://www.cert.pl/wp-content/uploads/2015/12/2013-06-p2p-rap_en.pdf}, language = {English}, urldate = {2020-01-13} } ZeuS-P2P monitoring and analysis
Gameover P2P
2015-08-05Black HatMichael Sandee, Tillmann Werner, Elliott Peterson
@techreport{sandee:20150805:gameover:fa47096, author = {Michael Sandee and Tillmann Werner and Elliott Peterson}, title = {{Gameover Zeus – Bad Guys and Backends}}, date = {2015-08-05}, institution = {Black Hat}, url = {https://www.blackhat.com/docs/us-15/materials/us-15-Peterson-GameOver-Zeus-Badguys-And-Backends.pdf}, language = {English}, urldate = {2020-01-06} } Gameover Zeus – Bad Guys and Backends
Gameover P2P
2015-02-06CrowdStrikeCrowdStrike
@techreport{crowdstrike:20150206:crowdstrike:fbcc37f, author = {CrowdStrike}, title = {{CrowdStrike Global Threat Intel Report 2014}}, date = {2015-02-06}, institution = {CrowdStrike}, url = {https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf}, language = {English}, urldate = {2020-05-11} } CrowdStrike Global Threat Intel Report 2014
BlackPOS CryptoLocker Derusbi Elise Enfal EvilGrab Gameover P2P HttpBrowser Medusa Mirage Naikon NetTraveler pirpi PlugX Poison Ivy Sakula RAT Sinowal sykipot taidoor
2014-10-14SymantecSymantec Security Response
@online{response:20141014:security:81c5ea5, author = {Symantec Security Response}, title = {{Security vendors take action against Hidden Lynx malware}}, date = {2014-10-14}, organization = {Symantec}, url = {https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware}, language = {English}, urldate = {2020-04-21} } Security vendors take action against Hidden Lynx malware
Gameover P2P HiKit Shylock APT17
2013-10MALWARE ConferenceDennis Andriesse, Christian Rossow, Brett Stone-Gross, Daniel Plohmann, Herbert Bos
@techreport{andriesse:201310:highly:bc65090, author = {Dennis Andriesse and Christian Rossow and Brett Stone-Gross and Daniel Plohmann and Herbert Bos}, title = {{Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus}}, date = {2013-10}, institution = {MALWARE Conference}, url = {http://www.syssec-project.eu/m/page-media/3/zeus_malware13.pdf}, language = {English}, urldate = {2020-01-08} } Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus
Gameover P2P
Yara Rules
[TLP:WHITE] win_gameover_p2p_auto (20230125 | Detects win.gameover_p2p.)
rule win_gameover_p2p_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.gameover_p2p."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 834c2418ff 6880000000 6a01 53 53 8d442430 50 }
            // n = 7, score = 100
            //   834c2418ff           | or                  dword ptr [esp + 0x18], 0xffffffff
            //   6880000000           | push                0x80
            //   6a01                 | push                1
            //   53                   | push                ebx
            //   53                   | push                ebx
            //   8d442430             | lea                 eax, [esp + 0x30]
            //   50                   | push                eax

        $sequence_1 = { 8d83c8000000 0fb7d0 8bc2 3bd9 7d0b 663bd1 }
            // n = 6, score = 100
            //   8d83c8000000         | lea                 eax, [ebx + 0xc8]
            //   0fb7d0               | movzx               edx, ax
            //   8bc2                 | mov                 eax, edx
            //   3bd9                 | cmp                 ebx, ecx
            //   7d0b                 | jge                 0xd
            //   663bd1               | cmp                 dx, cx

        $sequence_2 = { 6a00 6a00 0fb6c3 83ec0c ff348560933902 8d4df4 e8???????? }
            // n = 7, score = 100
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   0fb6c3               | movzx               eax, bl
            //   83ec0c               | sub                 esp, 0xc
            //   ff348560933902       | push                dword ptr [eax*4 + 0x2399360]
            //   8d4df4               | lea                 ecx, [ebp - 0xc]
            //   e8????????           |                     

        $sequence_3 = { 8d4c242c e8???????? 85c0 0f95c7 }
            // n = 4, score = 100
            //   8d4c242c             | lea                 ecx, [esp + 0x2c]
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   0f95c7               | setne               bh

        $sequence_4 = { 85c0 750c 8d8c24180b0000 e8???????? 833d????????ff 7507 }
            // n = 6, score = 100
            //   85c0                 | test                eax, eax
            //   750c                 | jne                 0xe
            //   8d8c24180b0000       | lea                 ecx, [esp + 0xb18]
            //   e8????????           |                     
            //   833d????????ff       |                     
            //   7507                 | jne                 9

        $sequence_5 = { 8d4d08 e8???????? 8d45f4 50 8d4d08 e8???????? 84c0 }
            // n = 7, score = 100
            //   8d4d08               | lea                 ecx, [ebp + 8]
            //   e8????????           |                     
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   50                   | push                eax
            //   8d4d08               | lea                 ecx, [ebp + 8]
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_6 = { 8d85e0fdffff 50 51 51 8bc6 0d00000004 50 }
            // n = 7, score = 100
            //   8d85e0fdffff         | lea                 eax, [ebp - 0x220]
            //   50                   | push                eax
            //   51                   | push                ecx
            //   51                   | push                ecx
            //   8bc6                 | mov                 eax, esi
            //   0d00000004           | or                  eax, 0x4000000
            //   50                   | push                eax

        $sequence_7 = { b002 a2???????? 85f6 7504 3c02 72b5 b001 }
            // n = 7, score = 100
            //   b002                 | mov                 al, 2
            //   a2????????           |                     
            //   85f6                 | test                esi, esi
            //   7504                 | jne                 6
            //   3c02                 | cmp                 al, 2
            //   72b5                 | jb                  0xffffffb7
            //   b001                 | mov                 al, 1

        $sequence_8 = { 330495e82b3902 41 4e 75e2 53 57 83fe20 }
            // n = 7, score = 100
            //   330495e82b3902       | xor                 eax, dword ptr [edx*4 + 0x2392be8]
            //   41                   | inc                 ecx
            //   4e                   | dec                 esi
            //   75e2                 | jne                 0xffffffe4
            //   53                   | push                ebx
            //   57                   | push                edi
            //   83fe20               | cmp                 esi, 0x20

        $sequence_9 = { 8be9 56 8b4500 48 48 7418 48 }
            // n = 7, score = 100
            //   8be9                 | mov                 ebp, ecx
            //   56                   | push                esi
            //   8b4500               | mov                 eax, dword ptr [ebp]
            //   48                   | dec                 eax
            //   48                   | dec                 eax
            //   7418                 | je                  0x1a
            //   48                   | dec                 eax

    condition:
        7 of them and filesize < 598016
}
Download all Yara Rules