P2P ZeuS

S0016

About this malware

P2P ZeuS is a closed-source fork of the leaked version of the ZeuS botnet. It presents improvements over the leaked version, including a peer-to-peer architecture.

Techniques used1

Command and Control1

T1001.001Junk Data

Procedure examples1

Technique	Procedure example
T1001.001 Junk Data	P2P ZeuS added junk data to outgoing UDP packets to peer implants. Dell P2P ZeuS

Groups that use it0

None recorded.

Campaigns0

None recorded.

References1

Dell P2P ZeuS Open source
SecureWorks. (2012). The Lifecycle of Peer-to-Peer (Gameover) ZeuS. Retrieved August 19, 2015.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.