TA14-150A: GameOver Zeus P2P Malware

02/06/14, TA14-150A: GameOver Zeus P2P Malware
From: "US-CERT" <US-CERT@ncas.us-cert.gov>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

To: on@cs.ait.ac.th
Subject: TA14-150A: GameOver Zeus P2P Malware
From: "US-CERT" <US-CERT@ncas.us-cert.gov>
Date: Mon, 02 Jun 2014 06:11:45 -0500
Authentication-results: mail.cs.ait.ac.th (amavisd-new); dkim=pass (2048-bit key) header.d=ncas.us-cert.gov
Delivered-to: on@cs.ait.ac.th
Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=ncas.us-cert.gov; s=13q3; i=@ncas.us-cert.gov; h=Content-Transfer-Encoding: Content-Type:x-subscriber2:x-subscriber:X-AccountCode:Errors-To: Reply-To:MIME-Version:Message-ID:X-ReportingKey:Subject:Date:To: From; bh=2mrKPtbOsAARlp7k01tIFwKt+g8=; b=mjCf90+Kt/F2JJFll2NKBw6 /IP4tnwk+UEYo5FkOM99J/XX6FkTlqyeXQ3Z6je6NZ3/W4HD+Gs1VqShJJNdr/OM RU1jM197qd5K2GU/K9mBA+Xb4bfj4DkBGSA9fnPj5A4V3lphEbb0itz0/nZSyXqq jJKvStSqJZk7GrSq0efTQFRpNnltaCJiI6CRAszOvC7lNP5wW++iAsDK2EZaqmON 4ALyxVg5mVPfNwDUgBfPy5SxFyXAFK7bhLk4Azk3MbvBMrLZP8rqqX0cSKazgHO7 II7QoDZQVubyLQNG4wNepfZUzbxJ2QJyNprciwpro+5c6ATy50pfrZLxlOuTEPw= =
Reply-to: US-CERT@ncas.us-cert.gov

Title: TA14-150A: GameOver Zeus P2P Malware


National Cyber Awareness System:

06/02/2014 08:15 AM EDT

Original release date: June 02, 2014

Systems Affected

  • Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8
  • Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012


GameOver Zeus (GOZ), a peer-to-peer (P2P) variant of the Zeus family of bank credential-stealing malware identified in September 2011­1, uses a decentralized network infrastructure of compromised personal computers and web servers to execute command-and-control. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ), is releasing this Technical Alert to provide further information about the GameOver Zeus botnet.


GOZ, which is often propagated through spam and phishing messages, is primarily used by cybercriminals to harvest banking information, such as login credentials, from a victim’s computer2. Infected systems can also be used to engage in other malicious activities, such as sending spam or participating in distributed denial-of-service (DDoS) attacks. 

Prior variants of the Zeus malware utilized a centralized command and control (C2) botnet infrastructure to execute commands. Centralized C2 servers are routinely tracked and blocked by the security community1. GOZ, however, utilizes a P2P network of infected hosts to communicate and distribute data, and employs encryption to evade detection. These peers act as a massive proxy network that is used to propagate binary updates, distribute configuration files, and to send stolen data3. Without a single point of failure, the resiliency of GOZ’s P2P infrastructure makes takedown efforts more difficult1.


A system infected with GOZ may be employed to send spam, participate in DDoS attacks, and harvest users' credentials for online services, including banking services.


Users are recommended to take the following actions to remediate GOZ infections:

  • Use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date (see Understanding Anti-Virus Software for more information).
  • Change your passwords - Your original passwords may have been compromised during the infection, so you should change them (see Choosing and Protecting Passwords for more information).
  • Keep your operating system and application software up-to-date - Install software patches so that attackers can't take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it (see Understanding Patches for more information).
  • Use anti-malware tools - Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool (examples below) that will help with the removal of GOZ from your system.


 http://www.f-secure.com/en/web/home_global/online-scanner (Windows Vista, 7 and 8)

 http://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142 (Windows XP systems)


 http://goz.heimdalsecurity.com/ (Microsoft Windows XP, Vista, 7, 8 and 8.1)  


http://www.microsoft.com/security/scanner/en-us/default.aspx (Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows XP)


 http://www.sophos.com/VirusRemoval (Windows XP (SP2) and above)


 http://www.symantec.com/connect/blogs/international-takedown-wounds-gameover-zeus-cybercrime-network (Windows XP, Windows Vista and Windows 7)

 Trend Micro

 http://www.trendmicro.com/threatdetector (Windows XP, Windows Vista, Windows 7, Windows 8/8.1, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2)

 The above are examples only and do not constitute an exhaustive list. The U.S. Government does not endorse or support any particular product or vendor.


Revision History

  • Initial Publication

This product is provided subject to this Notification and this Privacy & Use policy.

This email was sent to olivier.nicole@cs.ait.ac.th using GovDelivery, on behalf of: United States Computer Emergency Readiness Team (US-CERT) · 245 Murray Lane SW Bldg 410 · Washington, DC 20598 · (703) 235-5110 Powered by GovDelivery

Previous message sorted by date: TA14-098A: OpenSSL 'Heartbleed' vulnerability (CVE-2014-0160)
Previous message sorted by thread: TA14-098A: OpenSSL 'Heartbleed' vulnerability (CVE-2014-0160)
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: Jun 2014