A Look At The New Gameover Zeus Variant

This Zscaler ThreatLabZ report analyzes a July 2014 resurgence of a Gameover Zeus (Zbot) banking-Trojan variant distributed via Cutwail spam attachments that download the payload, drop and run epoxs.exe from a Temp subfolder, create persistence via HKCU Run, inject into system processes and use a DGA with fast-flux C2 infrastructure to retrieve banking web-inject configurations. The analysis documents infection workflow, sample DGA domains, dropped batch cleanup behavior, and notes a reduction in resilience compared to prior P2P-enabled and rootkit-equipped variants while infections remain relatively low.