zeusmuseum. - Gameover

Gameover (Zeus-P2P, Peer-to-Peer Zeus, P2P Zeus, GoZ, Mapp)

26652 samples
After version 0.0.0.27, Gameover stopped using SBCID_BOT_VERSION for the version number
Based on the Gameover version 2014-05-28 reference sample deep dive:
- 1333 functions
- 255 encrypted strings
- The code is more object oriented than other Zeus variants
- It used a peer-to-peer (P2P) protocol and network as its primary command and control (C2) mechanism
- An initial set of peers was stored in the BaseConfig
- RC4, AES, and RSA were used in various parts of the P2P protocol
- Important data delivered via the P2P network was verified using a signature and embedded RSA public key
- A slightly modified BinStorage data structure was used for binary/config updates, commands, and data exfil
- It used a date-based domain generation algorithm (DGA) as a backup C2 mechanism to get a new peer list
- 28 commands
- Its webinjects used Perl Compatible Regular Expressions (PCRE)
- Checked socket data for credit card track data
- Keylogged various commerical banking apps, e.g. tellerplus, bancline, fidelity, jack henry, gplusmain
- Had a Virtual Network Computing (VNC) plugin

Actors (1)

Name: Evgeniy Mikhailovich Bogachev
- Aliases: lucky12345@jabber.org, lucky12345@jabber.cz, Lastik, Monster, bashorg@talking.cc, MonsterTrack, alexgarbarchuck@yahoo.com, ICQ 427297771

References (73)

2011-10-10: ZeuS Gets More Sophisticated Using P2P Techniques [78]
2011-10-11: P2P Version of Zeus Botnet Appears [458]
2011-10-16: Another Modified ZeuS Variant Seen in the Wild [386]
2011-11-06: Zeus Code Update Part 2 – Who is behind the recent changes? [159]
2011-11-21: Murofet v2.0 (ZeuS P2P) [271]
2011-11-23: FBI Denver Cyber Squad Advises Citizens to be Aware of a New Phishing Campaign [119]
2011-11-28: Cracking into the New P2P Variant of Zeusbot/Spyeye [99]
2012-01-04: ZeuS – P2P+DGA variant – mapping out and understanding the threat [77]
2012-02-22: Zeusbot/Spyeye P2P Updated, Fortifying the Botnet [111]
2012-03-01: DGAs and Cyber-Criminals: A Case Study [377]
2012-07-23: The Lifecycle of Peer-to-Peer (Gameover) ZeuS [97]
2012-09-25: ZeuS Gameover Overview [217]
2013-06-01: ZeuS-P2P monitoring and analysis [61]
2013-10-04: Upatre: Another Day Another Downloader [332]
2013-10-22: Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus [96]
2014-02-18: Me puppet master: Behind the scenes of crawling P2P botnets [308]
2014-02-27: Notorious “Gameover” malware gets itself a kernel-mode rootkit… [236]
2014-03-09: Analysis of ZeuS GameOver with Necurs [372]
2014-03-14: Top Banking Botnets of 2013 [237]
2014-06-02: Alert (TA14-150A) GameOver Zeus P2P Malware [79]
2014-06-02: Assistant Attorney General Leslie R. Caldwell Delivers Remarks for the Gameover Zeus and Cryptolocker Operations and Related Criminal Charges [454]
2014-06-02: Deputy Attorney General James Cole Delivers Remarks at Press Conference for Gameover Zeus and Cryptolocker Operations [453]
2014-06-02: FBI disrupts GameOver ZeuS and CryptoLocker Botnet [333]
2014-06-02: Is the Game Over for GameOver Zeus? [355]
2014-06-02: Remarks by Robert Anderson Executive Assistant Director Federal Bureau of Investigation [455]
2014-06-02: U.S. Leads Multi-National Action Against “Gameover Zeus” Botnet and “Cryptolocker” Ransomware, Charges Botnet Administrator [80]
2014-06-02: ‘Operation Tovar’ Targets ‘Gameover’ ZeuS Botnet, CryptoLocker Scourge [83]
2014-06-03: The GameOver Zeus/CryptoLocker Indictment [285]
2014-06-03: To Catch a Cyberthief: How the FBI foiled the dangerous malwares GameOver Zeus and Cryptolocker. [405]
2014-06-06: McAfee Labs Threat Advisory: PWS ZBot [390]
2014-06-08: Gameover Zeus & Cryptolocker [411]
2014-06-08: Shadowserver Gameover Zeus DGA HTTP (20140530) [412]
2014-06-09: Backstage with the Gameover Botnet Hijackers [195]
2014-07-10: Breaking: GameOver Zeus Mutates, Launches Attacks [165]
2014-07-10: Crooks Seek Revival of ‘Gameover Zeus’ Botnet [167]
2014-07-11: Gameover Zeus re-emerges without peer-to-peer capability [84]
2014-07-11: New GameOver Zeus Variant uses FastFlux C&C [168]
2014-08-06: Gameover Zeus Variants Targeting Ukraine, US [87]
2014-08-18: The Zeus botnet and the making of a cyber crime market [414]
2015-02-25: FBI: $3M Bounty for ZeuS Trojan Author [204]
2015-06-18: The Hunt for the Financial Industry's Most-Wanted Hacker [88]
2015-08-05: FBI 'Most Wanted' Cybercrime Kingpin Linked To Russian Espionage On US Government [63]
2015-08-05: GameOver Zeus – Backgrounds on the Badguys and the Backends [232]
2015-08-05: Gameover Zeus -- Bad Guys and Backends [218]
2015-08-05: Inside the $100M ‘Business Club’ Crime Gang [334]
2015-10-07: Deputy Attorney General Press Conference for Gameover Zeus and Cryptolocker Operations [441]
2015-12-29: GameOver Zeus: Badguys And Backends [421]
2016-12-29: FACT SHEET: Actions in Response to Russian Malicious Cyber Activity and Harassment [423]
2017-02-28: Documents and Resources from the Gameover Zeus / Cryptolocker Press Conference [457]
2017-03-12: Russian Espionage Piggybacks on a Cybercriminal’s Hacking [85]
2017-03-21: Inside the Hunt for Russia’s Most Notorious Hacker [185]
2017-04-18: Configuring Zeus: A case study of online crime target selection and knowledge transmission [358]
2017-05-15: Evolution of the GOLD EVERGREEN Threat Group [203]
2018-11-28: The $100 Million Bot Heist: The story of the world’s most-wanted cybercriminal. [407]
2019-04-21: The growing partnership between Russia's government and cybercriminals [415]
2019-07-01: Exposing Evgeniy Mikhaylovich Bogachev and the "Jabber ZeuS" Gang - An OSINT Analysis [172]
2019-11-18: Why Were the Russians So Set Against This Hacker Being Extradited? [256]
2019-12-16: Inside ‘Evil Corp,’ a $100M Cybercrime Menace [255]
2019-12-18: Zeus Gameover [33]
2019-12-18: win.gameover_dga [20]
2019-12-18: win.gameover_p2p [19]
2020-01-25: EVGENIY MIKHAILOVICH BOGACHEV [69]
2020-01-25: Gameover ZeuS [70]
2020-02-25: Operation Tovar [82]
2020-07-17: The malware Dridex: origins and uses [166]
2021-01-04: Stopping Serial Killer: Catching the Next Strike [266]
2021-04-15: 20$ Bounty on Bogachev [283]
2021-06-08: The blurry boundaries between nation-state actors and the cybercrime underground [312]
2021-07-08: Inside the FBI, Russia, and Ukraine’s failed cybercrime investigation [301]
2022-02-22: EP 111: ZeuS [396]
2022-12-11: The non-mythological story of Zeus #botnet [450]
2023-02-09: U.S., U.K. Sanction 7 Men Tied to Trickbot Hacking Group [451]
2023-04-26: Gootloader Unloaded: Researchers Launch Multi-Pronged Offensive Against Gootloader, Cutting Off Traffic to Thousands of Gootloader Web Pages and Using the Operator’s Very Own Tactics to Protect End-Users [456]

Version	Count	ITW	IOCs	Reference Sample	Notes
0.0.0.17	40	2011-09-13	Samples	d935c6883744416102e2be4498623103a150fdbcb0a702240455f5d40f330bf4 (VT MB)
0.0.0.18	22	2011-09-28	Samples	bea5c56d864e39deef5d23cb9143f8572030da6b1df49a23d7d7151361de34ab (VT MB)
0.0.0.19	6	2011-10-10	Samples	c381ea5f5924e2b62d56e5c9ff223598649ff8884a0f88c4362409190bcc5f3e (VT MB)
0.0.0.20	44	2011-10-13	Samples	d7c1fc3ccb794a45e2d26267ee537ed174773f7d67114e23585e2b2c565257cb (VT MB)
0.0.0.21	335	2011-11-08	Samples	d6a8fb2eea4ebfd8d25afde9234335afca980c7c49d94ebda88db4a00c493c87 (VT MB)
0.0.0.22	461	2011-12-18	Samples	a9dc22ed99b7c1871feb8da431e67610223089936bbe1332b82120232850ec1c (VT MB)
0.0.0.25	22	2012-01-17	Samples	07f21e8acc3843aa44347b928c180902577a40850a8c671065920cb81ea8beb3 (VT MB)
0.0.0.27	1401	2012-01-24	Samples	85c484e63143a822a269e0a5225d4e55f71db303647427ce3fc89cefaad9261a (VT MB)
no_version	24320	2012-10-10	Samples Samples Samples	597fc22a39550c674c3be03b2ba21d9c54571389744d8240a7a1f416bdd2b4a9 (VT MB)	Sample's PE date (2014-05-28) is a few days before the Operation Tovar takedown on 2014-06-02.
newgoz	1	2014-07-10	Samples	3ff49706e78067613aa1dcf0174968963b17f15e9a6bc54396a9f233d382d0e6 (VT MB)	Post takedown version that removed P2P functionality and used HTTP C2 communications with a new DGA.

curator@zeusmuseum.com / @tildedennis