Orz

Malware & Tools · Orz

· MalwareS0229 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Orz is a custom JavaScript backdoor used by Leviathan. It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)

Tactic Coverage

discovery (5)stealth (4)command and control (2)privilege escalation (1)execution (1)defense impairment (1)persistence (1)

Used By (1 groups)

G0065LeviathanMUDCARP, Kryptonite Panda

Techniques (13)

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1055.012Process Hollowing

stealthprivilege escalation

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070Indicator Removal

stealth

References

https://attack.mitre.org/software/S0229 https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html