SYMBOLCOMMON_NAMEaka. SYNONYMS
win.gameover_p2p (Back to overview)

Gameover P2P

aka: GOZ, Mapp, ZeuS P2P

Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware. In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.

References
2022-04-27ANSSIANSSI
@techreport{anssi:20220427:le:5d47343, author = {ANSSI}, title = {{LE GROUPE CYBERCRIMINEL FIN7}}, date = {2022-04-27}, institution = {ANSSI}, url = {https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf}, language = {French}, urldate = {2022-05-05} } LE GROUPE CYBERCRIMINEL FIN7
Bateleur BELLHOP Griffon SQLRat POWERSOURCE Andromeda BABYMETAL BlackCat BlackMatter BOOSTWRITE Carbanak Cobalt Strike DNSMessenger Dridex DRIFTPIN Gameover P2P MimiKatz Murofet Qadars Ranbyus SocksBot
2021-09-09Recorded FutureInsikt Group
@techreport{group:20210909:dark:cd6bb6a, author = {Insikt Group}, title = {{Dark Covenant: Connections Between the Russian State and Criminal Actors}}, date = {2021-09-09}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf}, language = {English}, urldate = {2021-09-10} } Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus
2021-06-08Intel 471Intel 471
@online{471:20210608:blurry:5b278e5, author = {Intel 471}, title = {{The blurry boundaries between nation-state actors and the cybercrime underground}}, date = {2021-06-08}, organization = {Intel 471}, url = {https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state}, language = {English}, urldate = {2021-06-16} } The blurry boundaries between nation-state actors and the cybercrime underground
Dridex Gameover P2P
2021-02-08Lawfare BlogDavid Hechler
@online{hechler:20210208:what:f742cf1, author = {David Hechler}, title = {{What Is the Point of These Nation-State Indictments?}}, date = {2021-02-08}, organization = {Lawfare Blog}, url = {https://www.lawfareblog.com/what-point-these-nation-state-indictments}, language = {English}, urldate = {2021-02-18} } What Is the Point of These Nation-State Indictments?
Gameover P2P Nymaim
2020-07-17CERT-FRCERT-FR
@techreport{certfr:20200717:malware:5c58cdf, author = {CERT-FR}, title = {{The Malware Dridex: Origins and Uses}}, date = {2020-07-17}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf}, language = {English}, urldate = {2020-07-20} } The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2019-12-19KrebsOnSecurityBrian Krebs
@online{krebs:20191219:inside:c7595ad, author = {Brian Krebs}, title = {{Inside ‘Evil Corp,’ a $100M Cybercrime Menace}}, date = {2019-12-19}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/}, language = {English}, urldate = {2020-11-02} } Inside ‘Evil Corp,’ a $100M Cybercrime Menace
Dridex Gameover P2P Zeus Evil Corp
2017-05-15SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20170515:evolution:d0e74ea, author = {Counter Threat Unit ResearchTeam}, title = {{Evolution of the GOLD EVERGREEN Threat Group}}, date = {2017-05-15}, organization = {Secureworks}, url = {https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group}, language = {English}, urldate = {2021-05-28} } Evolution of the GOLD EVERGREEN Threat Group
CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN
2017-03-21WiredGarrett M. Graff
@online{graff:20170321:inside:dc89cf2, author = {Garrett M. Graff}, title = {{Inside the Hunt for Russia's Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/?p=2171700}, language = {English}, urldate = {2020-01-13} } Inside the Hunt for Russia's Most Notorious Hacker
Gameover P2P
2017-03-21WiredGarrett M. Graff, Chad Hagen
@online{graff:20170321:inside:3dc9a2d, author = {Garrett M. Graff and Chad Hagen}, title = {{Inside the Hunt for Russia’s Most Notorious Hacker}}, date = {2017-03-21}, organization = {Wired}, url = {https://www.wired.com/2017/03/russian-hacker-spy-botnet/}, language = {English}, urldate = {2021-07-20} } Inside the Hunt for Russia’s Most Notorious Hacker
Gameover P2P Murofet Zeus
2015-12CERT.PLCERT.PL
@techreport{certpl:201512:zeusp2p:47dc4ed, author = {CERT.PL}, title = {{ZeuS-P2P monitoring and analysis}}, date = {2015-12}, institution = {CERT.PL}, url = {https://www.cert.pl/wp-content/uploads/2015/12/2013-06-p2p-rap_en.pdf}, language = {English}, urldate = {2020-01-13} } ZeuS-P2P monitoring and analysis
Gameover P2P
2015-08-05Black HatMichael Sandee, Tillmann Werner, Elliott Peterson
@techreport{sandee:20150805:gameover:fa47096, author = {Michael Sandee and Tillmann Werner and Elliott Peterson}, title = {{Gameover Zeus – Bad Guys and Backends}}, date = {2015-08-05}, institution = {Black Hat}, url = {https://www.blackhat.com/docs/us-15/materials/us-15-Peterson-GameOver-Zeus-Badguys-And-Backends.pdf}, language = {English}, urldate = {2020-01-06} } Gameover Zeus – Bad Guys and Backends
Gameover P2P
2015-02-06CrowdStrikeCrowdStrike
@techreport{crowdstrike:20150206:crowdstrike:fbcc37f, author = {CrowdStrike}, title = {{CrowdStrike Global Threat Intel Report 2014}}, date = {2015-02-06}, institution = {CrowdStrike}, url = {https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf}, language = {English}, urldate = {2020-05-11} } CrowdStrike Global Threat Intel Report 2014
BlackPOS CryptoLocker Derusbi Elise Enfal EvilGrab Gameover P2P HttpBrowser Medusa Mirage Naikon NetTraveler pirpi PlugX Poison Ivy Sakula RAT Sinowal sykipot taidoor
2014-10-14SymantecSymantec Security Response
@online{response:20141014:security:81c5ea5, author = {Symantec Security Response}, title = {{Security vendors take action against Hidden Lynx malware}}, date = {2014-10-14}, organization = {Symantec}, url = {https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware}, language = {English}, urldate = {2020-04-21} } Security vendors take action against Hidden Lynx malware
Gameover P2P HiKit Shylock APT17
2013-10MALWARE ConferenceDennis Andriesse, Christian Rossow, Brett Stone-Gross, Daniel Plohmann, Herbert Bos
@techreport{andriesse:201310:highly:bc65090, author = {Dennis Andriesse and Christian Rossow and Brett Stone-Gross and Daniel Plohmann and Herbert Bos}, title = {{Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus}}, date = {2013-10}, institution = {MALWARE Conference}, url = {http://www.syssec-project.eu/m/page-media/3/zeus_malware13.pdf}, language = {English}, urldate = {2020-01-08} } Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus
Gameover P2P
Yara Rules
[TLP:WHITE] win_gameover_p2p_auto (20221125 | Detects win.gameover_p2p.)
rule win_gameover_p2p_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.gameover_p2p."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d4c2418 e8???????? 85c0 7524 395f08 7448 e8???????? }
            // n = 7, score = 100
            //   8d4c2418             | lea                 ecx, [esp + 0x18]
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7524                 | jne                 0x26
            //   395f08               | cmp                 dword ptr [edi + 8], ebx
            //   7448                 | je                  0x4a
            //   e8????????           |                     

        $sequence_1 = { c645fc01 e8???????? b001 c9 c3 55 8bec }
            // n = 7, score = 100
            //   c645fc01             | mov                 byte ptr [ebp - 4], 1
            //   e8????????           |                     
            //   b001                 | mov                 al, 1
            //   c9                   | leave               
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp

        $sequence_2 = { ff4c242c 0f8503ffffff 896c2460 8bf3 8d4c2454 e8???????? 8d4c241c }
            // n = 7, score = 100
            //   ff4c242c             | dec                 dword ptr [esp + 0x2c]
            //   0f8503ffffff         | jne                 0xffffff09
            //   896c2460             | mov                 dword ptr [esp + 0x60], ebp
            //   8bf3                 | mov                 esi, ebx
            //   8d4c2454             | lea                 ecx, [esp + 0x54]
            //   e8????????           |                     
            //   8d4c241c             | lea                 ecx, [esp + 0x1c]

        $sequence_3 = { 83e4f8 81ec7c060000 56 8bf1 8d8c2410010000 e8???????? 8364240800 }
            // n = 7, score = 100
            //   83e4f8               | and                 esp, 0xfffffff8
            //   81ec7c060000         | sub                 esp, 0x67c
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   8d8c2410010000       | lea                 ecx, [esp + 0x110]
            //   e8????????           |                     
            //   8364240800           | and                 dword ptr [esp + 8], 0

        $sequence_4 = { 89442414 50 8d442464 50 8d842470020000 50 ff15???????? }
            // n = 7, score = 100
            //   89442414             | mov                 dword ptr [esp + 0x14], eax
            //   50                   | push                eax
            //   8d442464             | lea                 eax, [esp + 0x64]
            //   50                   | push                eax
            //   8d842470020000       | lea                 eax, [esp + 0x270]
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_5 = { e8???????? 8d442424 50 8d442424 50 6a00 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   8d442424             | lea                 eax, [esp + 0x24]
            //   50                   | push                eax
            //   8d442424             | lea                 eax, [esp + 0x24]
            //   50                   | push                eax
            //   6a00                 | push                0

        $sequence_6 = { 03cb 8988bc160000 4a 8955fc 81fa00010000 7309 0fb6b2f8273902 }
            // n = 7, score = 100
            //   03cb                 | add                 ecx, ebx
            //   8988bc160000         | mov                 dword ptr [eax + 0x16bc], ecx
            //   4a                   | dec                 edx
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   81fa00010000         | cmp                 edx, 0x100
            //   7309                 | jae                 0xb
            //   0fb6b2f8273902       | movzx               esi, byte ptr [edx + 0x23927f8]

        $sequence_7 = { 85c0 0f85cc010000 53 8d54242c b994000000 e8???????? 8b542408 }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   0f85cc010000         | jne                 0x1d2
            //   53                   | push                ebx
            //   8d54242c             | lea                 edx, [esp + 0x2c]
            //   b994000000           | mov                 ecx, 0x94
            //   e8????????           |                     
            //   8b542408             | mov                 edx, dword ptr [esp + 8]

        $sequence_8 = { 51 8bcf e8???????? 0fb64502 53 6830750000 }
            // n = 6, score = 100
            //   51                   | push                ecx
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     
            //   0fb64502             | movzx               eax, byte ptr [ebp + 2]
            //   53                   | push                ebx
            //   6830750000           | push                0x7530

        $sequence_9 = { 894dcc 8d4ddc 51 6880000000 50 57 ff15???????? }
            // n = 7, score = 100
            //   894dcc               | mov                 dword ptr [ebp - 0x34], ecx
            //   8d4ddc               | lea                 ecx, [ebp - 0x24]
            //   51                   | push                ecx
            //   6880000000           | push                0x80
            //   50                   | push                eax
            //   57                   | push                edi
            //   ff15????????         |                     

    condition:
        7 of them and filesize < 598016
}
Download all Yara Rules