The sub-techniques beta is now live! Read the release blog post for more info.
SOFTWARE
SOFTWARE
1-9
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Y-Z
  1. Home
  2. Software
  3. Orz

Orz

Orz is a custom JavaScript backdoor used by Leviathan. It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. [1] [2]

ID: S0229
Associated Software: AIRBREAK
Type: MALWARE
Platforms: Windows
Version: 2.0
Created: 18 April 2018
Last Modified: 15 October 2019

Associated Software Descriptions

Name Description
AIRBREAK [2]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 Command-Line Interface

Orz can execute shell commands.[1]
Enterprise T1083 File and Directory Discovery

Orz can gather victim drive information.[1]
Enterprise T1070 Indicator Removal on Host

Orz can overwrite Registry settings to reduce its visibility on the victim.[1]
Enterprise T1027 Obfuscated Files or Information

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.[1]
Enterprise T1057 Process Discovery

Orz can gather a process list from the victim.[1]
Enterprise T1093 Process Hollowing

Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.[1]
Enterprise T1117 Regsvr32

Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.[1]
Enterprise T1105 Remote File Copy

Orz can download files onto the victim.[1]
Enterprise T1064 Scripting

Orz can execute commands with script as well as execute JavaScript.[1]
Enterprise T1518 Software Discovery

Orz can gather the victim's Internet Explorer version.[1]
Enterprise T1082 System Information Discovery

Orz can gather the victim OS version and whether it is 64 or 32 bit.[1]
Enterprise T1016 System Network Configuration Discovery

Orz can gather victim proxy information.[1]
Enterprise T1102 Web Service

Orz has used Technet and Pastebin web pages for command and control.[1]

Groups That Use This Software

ID Name References
G0065 Leviathan [1]

References

  1. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  1. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.