Eorezo

Overview

Adware:Win32/Eorezo is a massive, highly organized adware and browser hijacker network, originating primarily in France, that aggressively monetizes infected endpoints through forced advertisements.

Understanding Eorezo
To the end-user, Eorezo renders a computer nearly unusable by injecting in-text hyperlinks, pop-up ads, and fake security warnings into every visited webpage, while locking the homepage to a French affiliate search engine. For security analysts, Eorezo represents a severe compromise of the browser's security boundary. It acts as a Man-in-the-Browser (MitB), utilizing local proxies and rogue root certificates to intercept and decrypt SSL/TLS traffic.

Execution and Evasion Strategies
Eorezo is distributed via pay-per-install (PPI) software bundlers, often attached to fake Java updates or pirated software. Once installed, it drops its toolbars (like 'PCTuto' or 'SoftwareUpdate') and rogue extensions across all browsers. It establishes persistence by modifying the Windows Internet Options to route all traffic through a local proxy controlled by the adware. It protects its components by installing a Windows Service that actively monitors the registry; if a user attempts to remove the proxy settings, the service instantly reverts them.

Indicators of Compromise (IoCs)
Incident responders should immediately audit the Windows Certificate Store for unauthorized, self-signed Root CAs, which Eorezo uses to facilitate its HTTPS interception. Threat hunters will find anomalous proxy configurations in the registry (<code>HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings). Network logs will reveal massive volumes of HTTP GET requests directed at known ad-tracking networks based in France.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_EOREZO {
    meta:
        description = "Detects Eorezo (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "eorezo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Eorezo Activity
id: 5ec763d1e4498e6491e1056ae673f34a
status: experimental
description: Detects generic indicators of the eorezo malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*eorezo*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint to halt the exfiltration of intercepted web traffic and prevent further click-fraud.
2. Open the Windows Certificate Manager (certmgr.msc) and forcefully delete any rogue Root Certificates installed by Eorezo.
3. Remove the unauthorized local proxy configuration from Windows Internet Options and flush the DNS cache.
4. Audit the Windows Services (services.msc) to identify and disable the watchdog service protecting the adware.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to log into secure corporate or financial portals while infected, as Eorezo decrypts and inspects all SSL traffic.
2. Avoid relying solely on Chrome's extension manager for removal; the local proxy and Windows Service must be neutralized first.

References & External Analysis

• Search "eorezo" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Istartsurfinstaller
• Pccleanup
• Extcrome
• Advpassman
• Toggle

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/eorezo.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.