# MA-400.062014: MyCERT Advisory - GameOver Zeus P2P Malware

**Date:** 05 Jun 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-400.062014  
**Advisory ID:** MA-400.062014

---

**1.0 Introduction**
GameOver Zeus (GOZ) is a peer-to-peer (P2P) variant of the Zeus family of bank credential-stealing malware identified in September 2011 uses a decentralized network infrastructure of compromised personal computers and web servers to execute command-and-control [1].
**2.0 Mode of Infection**
GOZ, which is often propagated through spam and phishing messages, is primarily used by cybercriminals to harvest banking information, such as login credentials, from a victim’s computer [1].
Prior variants of the Zeus malware utilized a centralized command and control (C&C) botnet infrastructure to execute commands. Centralized C&C servers are routinely tracked and blocked by the security community. GOZ, however, utilizes a P2P network of infected hosts to communicate and distribute data, and employs encryption to evade detection. These peers act as a massive proxy network that is used to propagate binary updates, distribute configuration files, and to send stolen data. Without a single point of failure, the resiliency of GOZ’s P2P infrastructure makes takedown efforts more difficult [2, 3, 4].
**3.0 Impact**
A system infected with GOZ may be employed to send spam, participate in distributed denial-of-service (DDoS) attacks and harvest users' credentials for online services, including banking services.
**4.0 Affected Systems**
- Microsoft Windows 2000, XP, Vista, 7, and 8
- Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012
**5.0 Recommendation and Mitigation Steps**
Users are advised to do the following steps in order to mitigate GOZ infections:
- Use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date. [Read Understanding Anti-Virus Software for more information.](http://www.us-cert.gov/ncas/tips/ST04-005)
- Change your passwords - Your original passwords may have been compromised during the infection, so you should change them (see [Choosing and Protecting Passwords](http://www.us-cert.gov/ncas/tips/ST04-002) for more information).
- *Keep your operating system and application software up-to-date -* Install software patches so that attackers can't take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it (see [Understanding Patches](http://www.us-cert.gov/ncas/tips/ST04-006) for more information).
- *Use anti-malware tools* - Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool (examples tools provided below) that will help with the removal of GOZ from your system. Listed below is a non-exhaustive list of anti-malware tools:
> **F-Secure**
> Windows Vista, 7 and 8:
> <http://www.f-secure.com/en/web/home_global/online-scanner>
> Windows XP:
> <http://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142>
>
> **Heimdal**
> Microsoft Windows XP, Vista, 7, 8 and 8.1:
> <http://goz.heimdalsecurity.com/>
>
> **Microsoft**
> Windows 8.1, Windows 8, Windows 7, Windows Vista and Windows XP:
> <http://www.microsoft.com/security/scanner/en-us/default.aspx>
>
> **Sophos**
> Windows XP (SP2) and above:
> <http://www.sophos.com/VirusRemoval>
>
> **Symantec**
> Windows XP, Windows Vista and Windows 7:
> <http://www.symantec.com/connect/blogs/international-takedown-wounds-gameover-zeus-cybercrime-network>
>
> **Trend Micro**
> Windows XP, Windows Vista, Windows 7, Windows 8/8.1, Windows Server 2003, Windows Server 2008 and Windows Server 2008 R2:
> <http://www.trendmicro.com/threatdetector>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#afccd6cdcadd969696efccd6cdcadddccaccdaddc6dbd681c2d6) or [[email protected]](/cdn-cgi/l/email-protection#d5b8acb6b0a7a195b8acb6b0a7a1fbbaa7b2fbb8ac)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
**6.0 References**
1. US-CERT: Alert TA14-150A GameOver Zeus P2P Malware, June 2014 [online].
<http://www.us-cert.gov/ncas/alerts/TA14-150A>
2. [Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus](http://www.us-cert.gov/redirect?url=http%3A%2F%2Fwww.syssec-project.eu%2Fm%2Fpage-media%2F3%2Fzeus_malware13.pdf)
3. [Malware Targets Bank Accounts](http://www.fbi.gov/news/stories/2012/january/malware_010612/malware_010612)
4. [The Lifecycle of Peer-to-Peer (Gameover) ZeuS](http://www.us-cert.gov/redirect?url=http%3A%2F%2Fwww.secureworks.com%2Fcyber-threat-intelligence%2Fthreats%2FThe_Lifecycle_of_Peer_to_Peer_Gameover_ZeuS%2F)