Malware

GOZ

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Victims who visited these web sites were infected with the malware

T1566PhishingEvidence2

Then, on July 25, following a large spam campaign that distributed the new GOZ malware, the infection count jumped to 8,494 victims...

Credential Access

2 techniques

T1056Input CaptureEvidence2

The principal purpose of GOZ is to capture banking credentials from infected computers. One means by which GOZ accomplishes this is through ... attacks, in which GOZ intercepts sensitive information victims transmit from their computers.

T1056.003Web Portal CaptureEvidence1

the Defendants use GOZ to inject additional code into victims' web browsers that changes the appearance of the websites victims are viewing. For example, if a GOZ-infected user were to visit a banking website that typically requests only a username and password, the defendants could seamlessly inject additional form fields into the website displayed in the user's web browser that also request the user's social security number, credit card numbers, and other sensitive information.

Collection

2 techniques

T1056Input CaptureEvidence2

T1056.003Web Portal CaptureEvidence1

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

Individual infected computers, or "bots," are controlled remotely through a decentralized command and control ("C&C") system in which (a) ordinary infected computers, or "peers," remain in contact with each other; (b) specially selected peers called "proxy nodes" transmit commands and other information from the Defendants to the peers; and (c) a Domain Generation Algorithm ("DGA") is used to generate a large number of Internet domain names with which the infected computers communicate at least once a week.

T1105Ingress Tool TransferEvidence1

GOZ includes code that permits the defendants to install additional malicious software onto computers infected with GOZ. The defendants and their co-conspirators have used this capability to install Cryptolocker onto numerous computers within the GOZ botnet.

T1568.002Domain Generation AlgorithmsEvidence2

a Domain Generation Algorithm ("DGA") is used to generate a large number of Internet domain names with which the infected computers communicate at least once a week.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cso onlineNews

Aug 14, 2014

New Gameover Zeus botnet keeps growing, especially in the US | CSO Online

GOZ uses a domain generation algorithm (DGA) to produce large numbers of domains for command-and-control communication, making sinkholing and long-term botnet disruption difficult. The content describes it as malware distributed via spam campaigns and tracked through sinkholed domains to estimate infected hosts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

GOZ

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Victims who visited these web sites were infected with the malware

T1566PhishingEvidence2

Then, on July 25, following a large spam campaign that distributed the new GOZ malware, the infection count jumped to 8,494 victims...

Credential Access

2 techniques

T1056Input CaptureEvidence2

T1056.003Web Portal CaptureEvidence1

Collection

2 techniques

T1056Input CaptureEvidence2

T1056.003Web Portal CaptureEvidence1

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

T1105Ingress Tool TransferEvidence1

T1568.002Domain Generation AlgorithmsEvidence2

a Domain Generation Algorithm ("DGA") is used to generate a large number of Internet domain names with which the infected computers communicate at least once a week.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cso onlineNews

Aug 14, 2014

New Gameover Zeus botnet keeps growing, especially in the US | CSO Online

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.