{
  "family": "eorezo",
  "sample_count": 271,
  "category": "adware",
  "description": "EoRezo (cataloged across antimalware products as Adware:Win32/EoRezo, PUA:Win32/EORezo, and Adware.EoRezo) is a pervasive French adware platform and software bundler developed by the company Tuto4PC starting around 2011. Distributed extensively through deceptive software download portals, third-party software setup wrappers, and freeware video tutorial packages, EoRezo silently installs its background surveillance and ad-injection modules alongside legitimate programs. Once established, EoRezo creates persistent autostart services and scheduled tasks that run continuously, tracking user browsing habits, search queries, and application usage. The software routinely injects commercial advertising banners into visited web pages, triggers periodic desktop pop-up notifications, and redirects browser search queries through affiliate-monetized search engines, causing noticeable browser sluggishness and privacy degradation.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/EoRezo",
    "PUA:Win32/EORezo",
    "Adware.EoRezo",
    "Win32/EoRezo",
    "Tuto4PC.EoRezo"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the EoRezo adware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EoRezo is an aggressive adware application and software bundler created by Tuto4PC that injects ads and tracks web browsing habits."
      }
    },
    {
      "@type": "Question",
      "name": "How does EoRezo arrive on target workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside third-party software installers, free video tutorials, and deceptive freeware download managers."
      }
    },
    {
      "@type": "Question",
      "name": "What intrusive behaviors are caused by EoRezo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It displays persistent desktop pop-up ads, injects sponsored banners into web pages, and redirects search traffic to affiliate engines."
      }
    },
    {
      "@type": "Question",
      "name": "How does EoRezo maintain persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers Windows background system services and scheduled tasks to ensure automatic startup whenever Windows boots."
      }
    },
    {
      "@type": "Question",
      "name": "How can EoRezo be completely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall all Tuto4PC/EoRezo programs from Control Panel, delete its program directories, remove scheduled tasks, and reset browser settings."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2011,
  "motivation": "Ad Fraud",
  "lineage": {
    "derived_from": [
      "Tuto4PC Adware Framework"
    ],
    "variants": [
      "EoRezo.A",
      "EoRezo.Bundle",
      "EoRezo.Toolbar"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Terminate running EoRezo processes via Task Manager or administrative command prompts.",
    "Uninstall EoRezo and related Tuto4PC packages from Windows Programs and Features.",
    "Delete scheduled tasks configured under Windows Task Scheduler for EoRezo updates.",
    "Remove persistent program directories located under %PROGRAMFILES%\\EoRezo and reset web browser preferences."
  ],
  "what_to_avoid": [
    "Do not install freeware applications without reviewing advanced installation options and unchecking bundled software.",
    "Avoid downloading software utilities from third-party tutorial hosting sites."
  ],
  "iocs": {
    "file_hashes": [
      "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
      "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a"
    ],
    "delivery": [
      "Deceptive software wrappers on freeware portals and tutorial hosting sites",
      "Bundled installers utilizing pre-checked opt-in checkboxes"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\EoRezoUpdater",
      "Windows Service: EoRezoService"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/EoRezo",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/EoRezo"
    },
    {
      "name": "Malwarebytes Labs Threat Intelligence - Adware.EoRezo",
      "url": "https://www.malwarebytes.com/blog/detections/adware-eorezo"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}