{
  "family": "advload",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Advload is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Downloader or Adware dropper. It is designed to silently breach a system, establish a foothold, and then continuously reach out to remote servers to download and execute additional, unapproved software, primarily focusing on aggressive adware and browser hijackers to generate illicit pay-per-install revenue.<br><br><b>Understanding Advload (Adware Downloaders)</b><br>To an end-user, an Advload infection is initially silent, followed by a sudden, continuous cascade of new, unwanted applications appearing on their desktop and browsers. For a security team, it represents a persistent, open door on the endpoint that is constantly pulling down new malicious binaries (`T1105`), significantly expanding the attack surface and dragging down system performance.<br><br><b>Execution and Hijacking Mechanics</b><br>Advload is typically distributed via deceptive software bundles or fake software updates (like fake Flash Player installers). Upon execution, it minimizes its footprint to evade detection. It establishes robust persistence, often using Scheduled Tasks (`T1053.005`) set to trigger every few hours or upon user logon. The core functionality is a continuous loop: it connects to its Command and Control (C2) infrastructure, receives a manifest of new adware payloads, downloads them (`T1105`), and executes them silently in the background (`T1204.002`). This ensures the victim machine is perpetually infected with the latest adware variants.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns due to multiple ad-serving processes, and constant network beaconing. Host-based IoCs include the sudden, recurring appearance of multiple unknown applications in the Windows 'Programs and Features' list. EDR telemetry will show a single background process (the Advload core) repeatedly spawning new, randomly named child processes (the downloaded adware). Network IoCs include continuous, regular HTTP/HTTPS beaconing to known adware distribution networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1053.005",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Continuously downloading new adware payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Initial distribution vector via fake installers)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to immediately sever the connection to the adware distribution servers and stop the influx of new payloads.",
    "Open the Windows Task Scheduler and meticulously review all tasks, deleting any associated with the Advload dropper.",
    "Use the Windows Control Panel to manually uninstall all the recently installed adware applications pulled down by the dropper.",
    "Run a full, deep system scan with a reputable Adware/PUP removal tool to ensure the core Advload executable is eradicated."
  ],
  "what_to_avoid": [
    "Do not just uninstall the visible adware; if the Advload dropper is still running via a Scheduled Task, it will simply re-download them tomorrow.",
    "Avoid allowing users to execute software without administrative approval, as this breaks the initial adware infection chain."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}