Gameover (Zeus-P2P, Peer-to-Peer Zeus, P2P Zeus, GoZ, Mapp)

References (73)
Version Count ITW IOCs Reference Sample Notes
0.0.0.17 40 2011-09-13 d935c6883744416102e2be4498623103a150fdbcb0a702240455f5d40f330bf4 (VT MB)
0.0.0.18 22 2011-09-28 bea5c56d864e39deef5d23cb9143f8572030da6b1df49a23d7d7151361de34ab (VT MB)
0.0.0.19 6 2011-10-10 c381ea5f5924e2b62d56e5c9ff223598649ff8884a0f88c4362409190bcc5f3e (VT MB)
0.0.0.20 44 2011-10-13 d7c1fc3ccb794a45e2d26267ee537ed174773f7d67114e23585e2b2c565257cb (VT MB)
0.0.0.21 335 2011-11-08 d6a8fb2eea4ebfd8d25afde9234335afca980c7c49d94ebda88db4a00c493c87 (VT MB)
0.0.0.22 461 2011-12-18 a9dc22ed99b7c1871feb8da431e67610223089936bbe1332b82120232850ec1c (VT MB)
0.0.0.25 22 2012-01-17 07f21e8acc3843aa44347b928c180902577a40850a8c671065920cb81ea8beb3 (VT MB)
0.0.0.27 1401 2012-01-24 85c484e63143a822a269e0a5225d4e55f71db303647427ce3fc89cefaad9261a (VT MB)
no_version 24320 2012-10-10 597fc22a39550c674c3be03b2ba21d9c54571389744d8240a7a1f416bdd2b4a9 (VT MB) Sample's PE date (2014-05-28) is a few days before the Operation Tovar takedown on 2014-06-02.
newgoz 1 2014-07-10 3ff49706e78067613aa1dcf0174968963b17f15e9a6bc54396a9f233d382d0e6 (VT MB) Post takedown version that removed P2P functionality and used HTTP C2 communications with a new DGA.


curator@zeusmuseum.com / @tildedennis